dsh-api-client

Testing APIs inside DSH usually means either switching to Postman and losing your session context, or letting the Agent make raw HTTP calls with no audit trail. dsh-api-client collapses both into one native plugin: the human-facing debugger and the Agent tool functions share the same HTTP Executor, the same approval pipeline, and the same response store.

The UI delivers a Postman-class experience: a three-level Collection / Folder / Request tree, all seven HTTP methods, sectioned editors for Params, Headers, Auth, and Body, a JSON editor, and a response viewer with Pretty, Raw, and Preview modes. It imports Postman Collection v2.1 files directly, running a compatibility scan and producing a Migration Report; scripts are warned about but never executed, and partial incompatibilities do not block the import. On the security side, a five-layer model keeps things tight: environment secrets live in 0700/0600 files referenced via SecretRef, History and Agent Context are masked end-to-end, SSRF protection defaults to fail-closed against localhost and private ranges, redirects are re-evaluated hop by hop, and DNS rebinding is guarded. High-risk methods automatically enter the Approval flow.

This plugin is built for full-stack developers who debug back-end APIs inside DSH daily, AI engineers who want their agents to call external services safely and with a full audit log instead of hand-rolled curl wrappers, and tech leads who need to migrate a team Postman collection into DSH as a single debugging and documentation entry point. It hot-plugs without a DSH restart.