Request builder

Method - including QUERY, the safe, idempotent body-carrying method standardized by RFC 10008 - plus URL, query params, headers, and a body that can be JSON, XML, text, GraphQL, form-urlencoded, multipart, or a raw file. A Path tab fills the {name} placeholders in your URL’s path (e.g. /bag/{bagId}) - no hand-editing the raw URL - and the resolved preview shows the real target. JSON and XML get Validate and Format buttons, and Send doubles as Abort while a request is in flight. The response viewer shows raw, pretty JSON, XML, and HTML (auto-detected), plus headers. It is virtualized, so a multi-megabyte body stays responsive: collapsible nodes, syntax highlighting, find-in-response, and a soft-wrap toggle that remembers whether you left it on, across responses and across restarts. There is a status line like 200 OK · 1.2 KB · 87 ms, a Save response to file button that writes the full untruncated bytes, and a CORS advisory when a browser would have blocked the response - checked when your request carries an Origin header (Helena, being native, sends the request anyway).

Variables & environments

{{variable}} resolution everywhere - URL, query, headers, and body - with a live preview of the resolved URL. Variables resolve through a layered scope chain so the most specific value wins:

global → collection .env → collection → environment → folder → request → script overlay

Plus dynamic values like {{$guid}}, {{$timestamp}}, and ask-at-send {{?Name}} prompt variables.

Authentication

Nine schemes, all with {{var}} substitution and credentials kept out of the committed YAML:

Basic · Bearer · API Key · OAuth 2.0 (client-credentials and authorization-code + PKCE, with token caching) · OAuth 1.0a (HMAC-SHA1) · WSSE · AWS Signature v4 · HTTP Digest (challenge/response) · NTLM (the multi-round Windows handshake).

Full authentication guide →

Scripting, tests & assertions

Pre/post JavaScript hooks (via the pure-Go goja engine) with a curated helena.* API - environment access, interpolate, sendRequest, cookie reads, hashing, base64, uuid, date/time helpers, sleep, and headless runner control. Verify responses with a scripted test()/expect() framework or the no-code Assertions tab.

Request chaining

A request can declare other requests to run first; their results are bound as chain.<alias> for the leaf’s scripts and templates - so you can log in, then use the token, in a single Send.

Real-time - SSE & WebSocket

Stream Server-Sent Events straight into the response view, or open a WebSocket session (ws:// / wss://) with a live two-way transcript. Both protocols are hand-rolled on the Go standard library - no third-party network dependency.

Collections & the headless runner

Organize requests into workspaces, collections, and folders. Run a whole collection - or just one folder (select it and press Run, or helena run --folder <path>) - from the GUI, or headlessly from the CLI with helena run for CI: same resolution, scripts, and assertions as an interactive Send. It exits non-zero on any failure and can emit a --format json or --format junit report for CI dashboards.

Import & export

Import OpenAPI 3 / Swagger 2 / WSDL / Postman from a file or URL - OpenAPI 3.2 query operations arrive as QUERY requests, and its custom additionalOperations methods import too rather than being dropped. Export any request to cURL, wget, JavaScript fetch, Python requests, or Go net/http, or paste a cURL command to build a request.

Storage & privacy

Collections - folders, requests, and their environments - are plain Open Collection YAML on disk; diff and merge them like source code. Auth secrets and Secret-flagged variables are externalized to a store under your OS config dir (outside the repo), so a committed collection carries no cleartext credential. The session env overlay never touches disk. Structural changes save as you make them; request edits save on Mod+S, and quitting with edits still pending asks before discarding them.

Native niceties

Light / dark / system theme, a configurable request timeout and max response size, invalid-SSL and follow-redirects toggles, a cookie jar with a viewer, request history (Help → History - restore or resend a recent send; secret-scrubbed so no credential is written to disk), drag-and-drop to reorder collections, folders, and requests in the sidebar, a status bar showing your current version with an opt-in “Check for updates” (a one-shot GitHub check only when you click it - never automatic, in keeping with the no-phone-home guarantee), and keyboard shortcuts (Mod+Enter to send, Mod+S to save, …).

Features