■ Built for fintech & bank BR integrations

Prove your integration works
before it ever reaches production.

GDPR-safe fake data, native CPF/CNPJ/CEP Faker, and an isolated sandbox per partner — the reliability fintechs and banks need to open their API to third parties without risk.

Still a full stateful simulation, with native Chaos Mode for resilience testing — we didn't drop what already worked.

Create free account → See Partner Sandbox →

or explore without an account →

httpdrop / simulation LIVE

REQUEST FEED 0 req · avg --ms

RESPONSE BODY

// waiting...

proof of reliability

Built for teams that can't get sensitive data wrong.

GDPR-safe without breaking tests

Swap CPF, email, and card numbers for plausible fake data — right in the real API response, not just the log. Partners test end-to-end without ever seeing real data.

How it works →

Faker built for Brazil

CPF, CNPJ, and CEP with valid format and check digits, ready to populate any CRUD table in one click.

See Faker BR →

Isolated sandbox per partner

Scoped token, dedicated portal, and live docs per partner — billing consolidated in your account, production stays untouched during onboarding.

See Partner Sandbox →

why we exist

Modern API development is a simulation game. Every team faces the same problem: you need to test integrations before you have a real backend — but traditional mock tools are static, stateless, and impossible to make feel like production.

We built httpdrop to be different. Stateful by default. Chaos injectable per route. Real traffic capturable and convertible to rules. A simulation layer that behaves like real infrastructure — not like a JSON file.

the problem

Modern integrations are hard to test.

✗ Without httpdrop

Static mocks break with conditional logic
State resets on every test deploy
No way to simulate real per-route failures
Real traffic impossible to capture and replay
Shared environments cause test flakiness
No visibility into what was called and when

✓ With httpdrop

Stateful simulation — data persists between calls
Isolated environment per workspace, persistent
Chaos Mode per route: latency, 503, timeout
Capture real traffic and auto-generate rules
Isolated workspaces per team/suite
Full history with structured diff and replay

chaos control center

Control the blast radius of chaos. Straight from your pipeline.

Configure blast radius, duration, and status codes per route. Trigger, monitor, and stop experiments via API — without leaving your CI/CD workflow.

chaos control center ACTIVE

blast radius30%

duration120s

14 ok 4 errors

Configurable blast radius — 0.0 to 1.0, the exact % of requests affected.
Experiment duration in seconds, with guaranteed auto-stop.
Full lifecycle via API: start → stop → report, straight from your pipeline.

# 1. start experiment
curl -X POST .../api/endpoints/{id}/chaos/start
-d '{"blast_radius":0.3,"duration_s":120}'

# 2. stop experiment
curl -X POST .../api/experiments/{id}/stop

# 3. report
curl .../api/experiments/{id}/report

View Chaos docs →

platform capabilities

More than mock APIs.

Simulation

Stateful CRUD, Chaos Mode, and real traffic replay — real backend behavior, not just fixed responses.

Learn more ↓

Reliability

Dynamic templates, response sequences, and consistent Faker data across calls.

Learn more ↓

Observability

Live WebSocket, structured diff history, headers and latency on every request.

Integration

CLI, GitHub Action, JS/Python SDKs, and OpenAPI import/export — fits your pipeline.

Learn more ↓

Security & Compliance

RBAC, audit log, GDPR data masking, and on-premise deployment.

Learn more ↓

Developer Experience

Ready in 30 seconds, API Portal with live try-it, team workspaces.

show, don't tell

Simulate real backend behavior.

Auth flow

Auth flow simulation

Simulate login → token → refresh → expire sequences with stateful counters per session.

Payment instability

Inject 503 on every 3rd checkout attempt. Test retry logic, error UI, and fallback flows.

Full e-commerce

Full e-commerce simulation

Products, cart, orders, webhooks — all stateful, with Faker-generated BR data and chaos.

// Dynamic response template with state
{
  "attempts": {{store.incr('login_attempts')}}, ← increments on every call
  "user": "{{req.body.email}}", ← mirrors request
  "cpf": "{{faker.cpf}}" ← valid Brazilian CPF
}

traffic → rules

Learn from real traffic.

Point the proxy at your real API. httpdrop captures everything and converts to rules with 1 click.

Capture

→

02
Generate rules*

→

Replay flows

→

Simulate edge cases

Capture real requests from production or staging
Auto-generate Mock Rules from captured traffic
Replay full flows for regression testing
Simulate edge cases from real captured traffic
HAR export for automation and CI/CD

$ httpdrop tunnel --upstream https://api.meuapp.com

simulation engine

Programmable simulation engine.

Templates that react to request state, session data, and real-world conditions.

"token": "{{jwt.sign(req.body.user, store.get('secret'))}}"
"attempt": {{store.incr('login_attempts')}}
"cpf": "{{faker.cpf}}"
"user": "{{req.body.email}}"

State store persists across requests (incr, set, get)
Mirror request data: body, headers, query params
Brazilian Faker: CPF, CNPJ, CEP, names, prices
Conditional responses by method, path, or header value

use cases

Built for modern API workflows.

Frontend Teams

Develop without waiting on the backend

Import your OpenAPI and get a working mock in seconds.

QA Engineers

Isolated stateful test environments

Persistent state per suite. Data never mixes between environments.

Mobile Teams

Simulate full backends offline

Build mobile features without depending on backend infrastructure.

Platform Engineering

Simulation infrastructure as code

CLI, GitHub Action, SDKs and Docker. Integrate into your pipeline.

Fintech & Payments

Simulate payments and webhooks without touching production

Ready-made templates for Stripe, Mercado Pago. Chaos Mode for resilience testing.

Webhook-heavy Systems

Capture, replay and test webhooks with state

Simulate webhook delivery with retry, failure and stateful confirmation.

enterprise & governance

Built for teams and enterprise workflows.

Available

MFA / TOTP

TOTP + backup codes for all accounts

Available

RBAC

Owner / editor / viewer roles per workspace

Available

Workspace Permissions

Multi-tenancy with invites and granular control

Available

Audit Log

Partial

Activity History

Request history per endpoint (last 200)

Partial

Backups

Full workspace JSON export (endpoints, rules, data)

Available

Status Page

/health with DB check + public status page at /status

Partial

Encryption at Rest

TOTP secrets & sensitive vars encrypted (AES-256-GCM)

enterprise deployment

Deploy inside your infrastructure.

Total control. Data never leaves your server.

Production-ready Docker Compose
Data never leaves your infrastructure
LDAP / enterprise SSO support
Contractual SLA and dedicated support
Full audit log for compliance
Secrets and environment variable configuration

Talk to sales →

# docker-compose.yml
services:
  httpdrop:
    image: httpdrop/server:latest
    ports: ["3000:3000"]
    volumes:
      - ./data:/app/data
    environment:
      - SESSION_SECRET=your-secret

LGPD AES-256 Audit Logs On-Premise

// pricing

SIMPLE, NO SURPRISES

Start free. Upgrade when you need to. No contract.

Free

Experiment and light personal projects

Free

Limits

✓5 active endpoints
✓5,000 req/month (200/day)
✓History: 7 days
✗Shared workspace

Core

✓WebSocket live
✓CRUD with SQLite
✓Mock Rules
✓Faker
✓OpenAPI / Postman import
✓URL tester

Chaos Mode

✗No Chaos Mode

Start for free →

Name	Provider	Purpose	Expiry
session	httpdrop.com	User authentication session	Session
httpdrop_cookie_consent	httpdrop.com	Stores cookie consent preferences	365 days

Name	Provider	Purpose	Expiry
_ga	Google Analytics	Distinguish users	2 years
_ga_*	Google Analytics	Session state	2 years

Category	Cookies	Status
Necessary	session, httpdrop_cookie_consent	Always on
Analytics	_ga, _ga_*	Off
Marketing	_fbp	Off

Prove your integration works
before it ever reaches production.

Built for modern engineering teams.

Built for teams that can't get sensitive data wrong.

Modern integrations are hard to test.

Control the blast radius of chaos. Straight from your pipeline.

More than mock APIs.

A simulation layer between your frontend and the world.

Simulate real backend behavior.

Learn from real traffic.

Replay any captured request instantly.

Programmable simulation engine.

Built for modern API workflows.

Built for developer workflows.

Built for teams and enterprise workflows.

Deploy inside your infrastructure.

SIMPLE, NO SURPRISES

Simulate APIs like production.

Prove your integration worksbefore it ever reaches production.

Built for modern engineering teams.

Built for teams that can't get sensitive data wrong.

Modern integrations are hard to test.

Control the blast radius of chaos. Straight from your pipeline.

More than mock APIs.

A simulation layer between your frontend and the world.

Simulate real backend behavior.

Learn from real traffic.

Replay any captured request instantly.

Programmable simulation engine.

Built for modern API workflows.

Built for developer workflows.

Built for teams and enterprise workflows.

Deploy inside your infrastructure.

SIMPLE, NO SURPRISES

Simulate APIs like production.

Prove your integration works
before it ever reaches production.