Advanced curl: REST API testing, headers, auth, and timing.
low risk
Beyond basic downloads, curl supports all HTTP methods, custom headers, authentication, JSON bodies, and detailed timing breakdowns. The -w format flag extracts timing metrics making curl a powerful HTTP performance testing tool.
| Flag | Meaning |
|---|---|
-X --request | HTTP method (GET, POST, PUT, DELETE, PATCH) |
-H --header | Add request header |
-d --data | Request body |
-u --user | Basic auth user:password |
-k --insecure | Skip TLS verification |
-w --write-out | Output format for response metrics |
-s --silent | Suppress progress meter |
-o --output | Write response to file |
curl -X POST -H 'Content-Type: application/json' -d '{"key":"value"}' https://api.example.com/v1/resourcePOST JSON to REST API · explain & risk-check →curl -H 'Authorization: Bearer TOKEN' https://api.example.com/protectedAPI call with Bearer token · explain & risk-check →curl -w '\nTime: %{time_total}s\nHTTP: %{http_code}\n' -so /dev/null https://api.example.comCheck response time and HTTP status only · explain & risk-check →curl -I https://example.comHEAD request: show only response headers · explain & risk-check →curl -u admin:password https://jenkins.example.com/api/json | jq '.jobs[].name'Basic auth + jq parsing · explain & risk-check →Use `curl -w '%{time_namelookup} %{time_connect} %{time_starttransfer} %{time_total}\n' -so /dev/null URL` to break down DNS, TCP connect, and TTFB — pinpoints exactly where latency occurs.
Reference text is hand-written and may be incomplete — check man curl for your version. Test destructive commands on a non-production system first.