Features

A complete API client — every protocol, every auth scheme, every import path you'd expect from Postman, without the Electron tax.

Requests & responses

All HTTP methods with params, headers, and bodies (raw, GraphQL with variables, x-www-form-urlencoded, multipart with file parts, binary file uploads)
Automatic gzip / brotli / deflate decompression, redirect & timeout policy, response timing and size
Syntax-highlighted response viewer, save any response to disk, cancel in-flight requests
Save request-and-response pairs as reusable examples to revisit later
Request tabs over a real folder tree — the on-disk workspace structure is the tree
Command palette (⌘K) with fuzzy search across every request
Cookie jar with a manager to view, edit, and clear cookies, plus run history

Pre- and post-request JavaScript with an im.* API (sandboxed QuickJS), fully compatible with Postman pm.* scripts
Variable scopes (global → folder → environment → script → request) with {{var}} templating and dynamic variables
ƒx scripted environment values, evaluated live as you edit
Tests and assertions, console output, and variable extraction for request chaining
Variable audit — scan a workspace for unused, unset, and duplicated variables and clean them up in one click

API key (in a header or query param), Bearer, Basic, and Digest auth
AWS Signature v4 request signing
OAuth 2.0 — client credentials and authorization code + PKCE (opens your browser, loopback capture), with token caching and refresh
mTLS with PEM client certs or PKCS#12 (.p12/.pfx) bundles, plus custom CA bundles — registered per host, so any request to that host presents the right identity
Inherit auth from the nearest parent folder — set it once, reuse it everywhere
Secrets encrypted at rest (XChaCha20-Poly1305), keyed by the OS keychain (macOS Keychain / Windows Credential Manager) — never in workspace files
Sandboxed scripts and MCP commands don't run until you explicitly trust them, and reach secrets only when you opt in

Collection runner — run a folder, chain values, iterate over a CSV/JSON data file, aggregate pass/fail
Run reports — a post-run summary with a downloadable, self-contained HTML report to share
Folder-scoped settings — timeout and redirect policy, plus variables and auth that children inherit and any folder can override
Git-friendly storage: flat YAML, one request per file — clean diffs and easy review
Team sync over git — a Source Control panel to clone a shared workspace, commit, pull, push, and review a request-aware semantic diff; secrets stay on your machine (Team plan)
Open a workspace from Finder's Open With or Explorer's right-click menu, or reopen a recent one
Full data sovereignty — your data lives in datastores you control, never our storage
In-app auto-update, and a Rust core in an OS-native webview for fast startup and a small memory footprint

WebSocket console — connect, send, and watch frames live
Server-Sent Events (SSE) — stream and inspect events
Dynamic gRPC client — discover services via server reflection or load .proto files (unary + streaming)
MCP client — connect to Model Context Protocol servers over stdio or Streamable HTTP, discover tools, resources, and prompts, and invoke tools with JSON arguments

MCP server — connect your AI tool (Claude Desktop/Code, Cursor, GitHub Copilot) to Impostor and make your API workspace part of your agentic loop: browse, inspect, and run your saved requests
Copy a ready-to-paste config from the status bar, or one-click add it to a detected host
Targets the workspace you have open (no path to configure), yet stays safe: secrets are redacted, scripts never run, and it's path-jailed to the workspace
Letting the AI author requests, folders, and environments is opt-in — additive only, never destructive

Headless CLI — impostor run resolves a saved request (variables + folder inheritance) and sends it with no window; impostor ls lists the workspace
--json output and conventional exit codes drop it straight into scripts and CI

Import from cURL — paste a command, get a request
Import from Postman v2.1 — batch-import multiple collection and environment exports at once, auto-detected
Generate code: copy any request as cURL, fetch, Python, HTTPie, PowerShell, or wget