Endpoint Studio
Privacy Policy
Endpoint Studio is a Chrome extension for building, sending and testing HTTP, GraphQL, WebSocket and Server-Sent Events requests. It works on your device: it has no servers of its own, no accounts and no tracking.
Nothing is collectedThe developer receives no data from you, ever.
Stays on your deviceCollections, variables, secrets and history are saved only in your browser.
You choose every requestRequests go only to the addresses you enter, when you press Send or Run.
What Endpoint Studio sends, and where
- The requests you build. When you press Send, run a collection or a script calls
pm.sendRequest, Endpoint Studio sends that request (its URL, headers, body and authentication) directly from your browser to the server you entered. Nothing passes through any server of ours. - OAuth 2.0 sign-in. If you use OAuth 2.0 authorization, Endpoint Studio opens the authorization page you configured and exchanges the code with the token URL you configured. The token is stored on your device.
- Browser cookies. Like any request your browser makes, a request may include cookies your browser already holds for that site. Endpoint Studio does not read your browser's cookie store.
What Endpoint Studio stores
- Collections, requests, environments and variables, including any secrets and tokens you enter, in your browser's local storage (IndexedDB) on your device.
- Request history and runner results, on your device. Secret values are left out of history unless you turn that on in Settings.
- Preferences such as language and theme, in Chrome's extension storage on your device.
Exports leave out secrets unless you choose to include them. You can delete history, collections and environments at any time; removing the extension deletes all of its stored data.
Permissions and why they are needed
| Permission | Used for |
|---|---|
Access to all sites | Sending your requests to any API you choose without being blocked by the browser's cross-origin (CORS) rules. Endpoint Studio does not read or change the pages you browse and injects nothing into them. |
declarativeNetRequestWithHostAccess | Applying headers browsers normally forbid scripts to set (such as Cookie, User-Agent or Referer) to your own request only, for the moment it is sent. |
webRequest | Reading the raw response headers, Set-Cookie headers and redirect steps of requests sent from the Endpoint Studio tab, to show them to you. Traffic from other tabs is not observed. |
identity | Opening the OAuth 2.0 sign-in window when you request a token. |
storage, unlimitedStorage | Saving your workspace, history and preferences on your device, including large responses and data files. |
What Endpoint Studio does not do
- It does not collect, sell or share personal data, and has no analytics, advertising or tracking.
- It does not read, record or modify the websites you visit.
- It does not load code from the internet. Test scripts you write run in an isolated sandbox page inside the extension.
Children
Endpoint Studio does not knowingly collect information from anyone, including children.
Changes to this policy
If this policy changes, the updated version will be published at this address with a new effective date.