Calls

Calls is Short Leash's HTTP client: requests you save for a site and send to it, its share URL or any API, each coming back with what it caused on the site, its dump() calls, its queries and its log lines, next to the answer itself.

Calls is part of Short Leash Pro.

What does Short Leash promise about my calls?

• Calls need no account. They're part of Short Leash Pro: every Short Leash has them for its 14-day trial, and after that with a license.
• They stay on your computer, unless you turn on Keep in project folder to commit them.
• Export always works: Copy as cURL, an .http file or a Short Leash folder.
• Secret values never leave your computer: not in the project folder, not in History, not to AI tools.

How do I send one?

Open a site and choose Calls in its pages, then New call. Go to (⌘K, Ctrl+K on Windows) also has New call in … for each site. Pick the method, type the address and press Send, or ⌘↩ (Ctrl+Enter on Windows). Stop, or ⌘. (Ctrl+. on Windows), ends a send that's taking too long; Short Leash gives up on its own after two minutes.

An address that starts with / goes to the site: /api/orders is https://northwind.test/api/orders. A call's tabs hold the rest:

• Params: query parameters, each with a box to leave it out without deleting it.
• Headers: the call's own, below the ones it gets from its folder.
• Body: JSON, text, XML, a form, multipart fields and files, a file as it is, or a GraphQL query with its variables.
• Auth: how it signs in (see below).
• Checks: what the answer must look like, and values to keep for the calls after it.
• Docs: notes for whoever sends it next.

Calls save as you edit them. A call's menu, beside Saved, has Rename, Duplicate, Copy as cURL, Move to and Delete. History keeps the last 500 sends of each site, in memory, until Short Leash restarts.

What does "What it caused" show?

Everything the request made happen on the site, found by the id Short Leash's proxy gave it, so other requests at the same moment don't mix in:

• Dumps: each dump() and dd(), with its file and line.
• Queries: each query with its time, and Explain for any of them (see Explain).
• Log lines: what the request logged.
• Mail received while this ran: mail that arrived during the request. Mail carries no id, so it's matched by time and may come from something else.

Open in Requests shows the request as the site received it. Dumps, queries and log lines come from PHP sites (Laravel, WordPress, Symfony and other PHP); for other sites the answer and Requests are what you get. Queued jobs run in another process, so what they do shows on Dumps, not here.

Where does a call go?

Send to at the top picks the site itself or Its share URL, while the site is shared. {{site.url}} follows the choice, so the same calls work both ways.

• To the site, Short Leash hands the request to its proxy directly: no DNS, no certificates, the same on macOS and Windows. It shows on Requests like any other request. Timeline shows the site's time.
• To the share URL or any other address, it goes over the network, through Cloudflare and the share's access rules for a share, the way a visitor would reach it. Timeline shows each redirect and the time to the first byte.

Short Leash follows up to 10 redirects, and Timeline lists each one. When one goes to another host, it drops Authorization and cookies first.

How do variables and environments work?

Write {{name}} in any field: the address, a header, the body, auth. A value comes from, first to last: what an earlier call kept, the call's own variables, its folder's (the innermost first), then the environment picked at the top. Always there:

Environments holds sets of values, such as Local and Seeded admin. Turn on Secret for passwords and tokens: their values stay on your computer, in Short Leash's secrets file that only you can read. Calls, their folder and the project folder keep only the name, and History and AI tools see •••••• instead (for values of 4 characters or more; a shorter one would hide ordinary text everywhere). A missing variable stops the send before anything goes out and says which to set.

How does a call sign in?

Choose in Auth. A call can take its folder's auth (From the folder), so one Bearer token or sign-in covers a whole folder.

• Basic, Bearer token and API key (in a header or the query) send what you give them. Use a secret variable like {{token}} rather than typing the value: typed, it's saved with the call, and in the project folder when that's on.
• Laravel Sanctum sign-in does what a single-page app does: it gets /sanctum/csrf-cookie, posts the email and password to /login with the X-XSRF-TOKEN header, and keeps the session cookie for every call to the site after that. It signs in on the first send; Sign in again and Sign out are under Auth. The site's address has to be in SANCTUM_STATEFUL_DOMAINS. Routes imported from Laravel with auth:sanctum get it already.
• OAuth 2 gets a token with Client credentials, or Authorization code with PKCE in your browser: the provider sends you back to the site's own address, https://northwind.test/.well-known/leash/oauth, which Short Leash answers, so nothing leaves your computer. Add that address to the OAuth client. Tokens are kept with the secrets and refreshed when they run out.

Clear cookies in the More menu forgets the site's cookies and signs out.

How do checks work?

Checks compares the answer with what you expect, with no code to write: the status, a header, a value in a JSON body by JSONPath ($.data.id), the body or the time it took, with is, is not, is under, is over, contains, exists or matches (a regular expression). Each send runs them and marks each one passed or failed.

Keep for the next call reads a value from the answer (a JSONPath, a header or a cookie) into a variable, so Create order can keep order from $.data.id and Show order can send /api/orders/{{order}}.

Run every call in the More menu, or Run Orders in a folder's menu, sends its calls in order, each with what the ones before it kept, and lists which passed. Stop at the first failure stops there.

Calls don't run scripts: checks are rules Short Leash applies, so a collection from a repository can't run code on your computer.

How do I start from what I have?

Import brings calls in, and shows them before adding them:

• Routes: a Laravel or Symfony site's own routes, from php artisan route:list --json or bin/console debug:router, one call per route and method, in folders by their path. Routes with auth:sanctum sign in with Sanctum. Short Leash reads them again when the route files or composer.lock change, and at least every 10 minutes.
• Paste curl: a curl command, such as Copy as cURL from a browser's network tools.
• File: Postman collections and environments, OpenAPI 3.0 and 3.1 (JSON or YAML, or its address), Insomnia, Bruno and OpenCollection, .http files, HAR, or a Short Leash folder. Scripts in them are left out, with a note. An import keeps up to 64 MB: from a bigger file Short Leash adds what fits and says how many calls, so you can split the file and import the rest.

Out again: Copy as cURL on a call (with its variables filled in), or Export a site's calls as an .http file or a Short Leash folder. Open as call on a request in Requests or a webhook delivery makes it a call.

How much can one import bring in?

A file or paste can be up to 20 MB. A folder can hold up to 2,000 files, and the files a Bruno, OpenCollection or .http folder imports can be 20 MB together. YAML can hold up to 2,000,000 entries nested 64 deep, and its aliases (*name) can copy in up to 200,000 entries and 32 MB.

Everything an import from another tool's file keeps shares one budget of 64 MB, measured as the JSON Short Leash keeps and counted as each piece is added: its calls, folders, folder settings (sign-in, headers and variables), environments and warnings. 313,650 bytes of it are held for warnings, so they still fit once calls have filled the rest. Past the budget Short Leash stops adding: the preview says how many calls will be imported, with the folders and environments that fit, and leash call import says how many were once it has added them.

In every format:

• Call, folder and environment names are cut to one line of 80 characters.
• Parameter, header, path variable, form field and multipart field names are cut to 256 characters.
• A path variable the address names more than once is kept once, with the first value given for it.
• A call's docs are cut to 11,002 characters.
• An import keeps up to 100 warnings, each cut to 512 characters and each said once; past 100, one line says how many more there were. A sign-in type Short Leash doesn't do is quoted up to 64 characters.

In OpenAPI, as the file is read:

• Media types are cut to 128 characters, summaries to 1,000 and descriptions to 10,000. A call's docs are its summary, a blank line and its description.
• Operation ids, tags, path segments that name folders, parameter names, property names, sign-in scheme names, API key names and each scope are cut to 256 characters, and sign-in addresses and a call's scopes together to 2,048.
• The server address is cut to 2,048 characters before its variables are filled in, and again after.
• A $ref longer than 1,024 characters isn't followed, and $refs and schemas are followed 8 deep.
• The example bodies and values built from schemas do at most 200,000 values of work for the whole import. Their bytes count against the 64 MB as they're built, and again in the calls that keep them. Past either, they're cut short with a warning.
• A property whose name is a list or a map is skipped, with a warning.

In Insomnia, an environment's or folder's variable names (nested keys joined with dots, as a.b) stop at 256 characters: a key that would take a name past that is skipped with everything under it, and one warning says how many variables were skipped. Variables count against the 64 MB as they're made: once they'd pass it, the rest are left out, with a warning.

In Postman, folders nested more than 32 deep are left out with their calls, with a warning. In Insomnia v5 they're left out with their calls; in a v4 export they're left out and their calls go at the top.

Two imports don't go through the 64 MB budget, because their own limits bound them:

• A Short Leash calls folder is read as a site's own calls folder is: files up to 4 MB, 64 MB together.
• Routes come from the site's own route list, one call per route and method.

Whatever it came from, a site keeps up to 500 calls, 200 folders and 20 environments.

Where are calls kept?

In Short Leash's database, so they're there after a restart. A site keeps up to 500 calls, 200 folders and 20 environments, and Keep as example keeps an answer with its call (the last five).

Keep in project folder in the More menu writes the site's calls into a folder inside the project (calls/ unless you choose another) as one YAML file per call, to commit and share with your team:

calls/
  collection.yml
  orders/
    folder.yml
    create-order.yml
  environments/
    local.yml

If the folder already holds calls, from a teammate's commit say, Short Leash's are added beside them. Secret values are never written there, only their names. While it's on, the files are what counts: edit them in your editor and Short Leash reads them again when you come back to it. Short Leash doesn't read a file that uses YAML anchors or aliases (&name, *name) or is bigger than 4 MB, or a folder whose files add up to more than 64 MB: it names the file or folder, so you can write its values out in full or split it. If a file changed on disk and in Short Leash since Short Leash last wrote it, it says so: Use the file or Keep mine. Turning it off leaves the files where they are. See ADR 0050.

Can AI tools send calls?

Yes. leash mcp has list_calls, send_call, run_calls and list_routes, and send_call returns the answer with what it caused, so an agent can check its own change. AI tools can send to the site and its share URL. To let them call other hosts, such as an API the site uses, turn on Let AI tools call other hosts in the site's settings. Addresses on your computer and your local network stay off limits either way. See AI tools.

From a terminal, leash call send /api/orders, leash call run (exits with 1 when a call fails, for scripts and CI), leash call routes and leash call import do the same; see the CLI reference.