What is a mock API and why would I use one?

A mock API is a fake HTTP endpoint that returns responses you define, without a real backend. Developers use one to build and test a frontend before the backend is ready, to reproduce specific responses like errors or slow requests, and to develop offline. With MockBase you create a live mock endpoint in seconds and point your app at it.

How do I mock a REST API without writing any backend code?

Create a mock in MockBase, add a route such as GET /users, and set the JSON body and status code it should return. Your app calls the generated URL and gets that response. No server, no code, no deployment.

Can I test how my frontend handles errors and slow responses?

Yes. You can set any status code, add latency to simulate a slow network so you can see your loading states, and use chaos injection to make an endpoint fail randomly at a chosen rate.

Does it support dynamic responses based on the request?

Yes. You can return different responses based on query parameters, headers, or the request body, use templates to echo request data back, and enable a stateful CRUD mode where a resource behaves as if it has real state.

Can I import an existing OpenAPI or Swagger spec?

Yes. Paste an OpenAPI 3.x document in JSON or YAML and MockBase generates the routes for you, and you can export any mock back to an OpenAPI document.

You can try it without signing in, and every feature is free during the beta. There is a Pro tier for custom subdomains, API token protection, chaos testing, and a higher request quota, which is unlocked for free while the beta is running.

Blog

Custom Subdomains Match Exactly One Label, on Purpose

September 5, 2026Xerat022 min read

Claim a slug and your mock also answers at <slug>.mockbase.org instead of only mockbase.org/mock/<id>. The routing behind that is a single Host-header check, and it's stricter than it might look — deliberately.

The check

MockBase reads the incoming Host header, strips any port, lowercases it, and checks that it ends with .<base_host>. Whatever's left after removing that suffix has to be a single label — one segment, no dots — for the match to count. demo.mockbase.org resolves; demo.staging.mockbase.org does not, even though it technically "ends with" the base host too. If subdomain routing is disabled entirely (no base host configured), the check short-circuits and nothing matches.

Only when a request's Host header cleanly decomposes into exactly <label>.<base_host> does MockBase look up which mock owns that label and route the request to it.

Why "exactly one label" is the actual security property

The naive version of this feature — "does the Host header contain our domain?" — is a substring check, and substring checks on hostnames are a classic way to accidentally let something like mockbase.org.attacker.com or an unexpected multi-level subdomain slip through logic that wasn't built to handle it. Requiring the leftover portion to be a single, dot-free label rules that class of mismatch out structurally: there's no substring matching involved at all, just "does the host end with this exact suffix, and is there exactly one label in front of it."

It also means slug claims can't collide in confusing ways. A slug is a single label, claimed by exactly one mock at a time — there's no ambiguity about whether foo.bar.mockbase.org belongs to the owner of foo or bar, because that host simply never matches the routing rule in the first place.

What it costs you

No nested subdomains, no wildcard slugs, no multi-level namespacing under your own slug. For a feature whose entire job is "give this one mock a memorable, stable address," that's the right trade — the routing stays a single unambiguous string comparison instead of a general-purpose hostname parser, which is exactly the kind of code you want to be boring.

Xerat02

Building MockBase.

Your Mock's Access Token Is Shown to You Exactly Once

Turn on token protection and MockBase generates a token, shows it to you, and then — by design — never shows it to you again. Not in the UI, not through the API. If you didn't copy it, your only move is to rotate: generate a new one and invalidate the old.

Why Chaos Injection Uses a CSPRNG (and Rolls Fresh Every Request)

Real APIs fail sometimes — a flaky upstream, a timeout, a 500 under load. If your client code has never seen that happen, you don't actually know how it behaves when it does. Chaos injection makes MockBase fail on purpose, at a rate you choose, so you can find out before production does.