curl من الطرفية
في هذا الدرس 11 موضوعات
هذا الدرس متاح حاليًا باللغة الإنجليزية فقط، ولم تُنشر نسخته العربية بعد.
Lesson Overview
Postman is a comfortable practice table. curl is the same order placed by phone: no windows, no buttons, just one line of text. It is a command-line program that sends a request and prints the response. API documentation, bug reports, and tutorials are full of curl lines, because a single line can be copied, pasted, and run by anyone.
In this lesson you learn the handful of options that cover almost everything: the default GET, -i to see status and headers, -H to add a header, -d to send a body, and -X to choose a method. You will also learn two practical traps: quoting URLs that contain &, and how curl behaves in different terminals.
This lesson builds on Lessons 2 and 3 (resources, methods, status codes, headers and bodies in Postman) and on Module BEG-052 (HTTP anatomy, JSON). It assumes you can open a terminal (the terminal basics were taught earlier in the roadmap).
Learning Objectives
By the end of this lesson you will be able to:
- Send a
GETrequest withcurl URLand read the body. - Use
-ito show the status line and response headers. - Add a request header with
-Hand send a JSON body with-d. - Choose a method with
-Xand know what-Xdoes not do. - Quote a URL with query parameters correctly.
- Translate a Postman request into a
curlcommand and back.
Written Explanation
Is curl installed?
Many systems ship with curl. Check with:
curl --versionIf you see a version number, you are ready. If not, install it with your system's package manager or from the official site (see References). The commands below assume a Unix-style shell such as Bash.
Windows note. In Windows PowerShell (the older, built-in version), curl is an alias for the Invoke-WebRequest cmdlet, according to Microsoft's documentation, so curl -i may not behave like the real tool. To run the real program there, type curl.exe. Newer PowerShell versions and Git Bash behave differently, so if a command seems to be rejected with strange parameter errors, try curl.exe. Quoting rules also differ between Command Prompt, PowerShell, and Bash; the examples here use Bash style.
The simplest form
curl "https://dummyjson.com/products/1?select=title,price"With no options, curl sends a GET and prints the response body. Nothing else: no status, no headers. Fine for a quick look, risky when something goes wrong, which is why the next option matters.
When output goes to a file or pipe, curl may draw a progress meter. The option -s (silent) hides the progress meter and messages but still prints the data, as the manual explains. Add -S (or --show-error) with it if you still want to see errors. We use -s in this course to keep outputs clean.
-i: show the status and headers
The manual says -i (long form --show-headers in current versions, earlier --include) adds the response headers to the output. That means you see the status line first, then headers, then a blank line, then the body.
curl -s -i "https://dummyjson.com/products/1?select=title,price"The real output began like this (we cut the long middle part of the headers and replaced it with ...):
HTTP/1.1 200 OK
Date: Wed, 04 Nov 2026 06:19:10 GMT
Content-Type: application/json; charset=utf-8
...
{"id":1,"title":"Essence Mascara Lash Princess","price":9.99}This is the same information the Postman response pane displays: status, headers, body. Two relatives: -I (capital i) sends a HEAD request and prints only the headers, and -v (verbose) also shows the request that was sent.
Sometimes you only want the status code. The option -w (write-out) prints information about the finished transfer, and -o /dev/null throws away the body (on Windows cmd use NUL instead):
curl -s -o /dev/null -w "%{http_code}\n" "https://dummyjson.com/products/99999"Real output: 404.
-H: add a header
-H "Name: value" adds a header. You can repeat it. The most common one for APIs is the Content-Type of a body you send:
-H "Content-Type: application/json"-d: send a body
-d (--data) sends data as the request body. The manual says that for HTTP this uses the POST method, as a browser does when it submits a form, and it sends the data labeled application/x-www-form-urlencoded unless you say otherwise. For a JSON API that is usually not what you want, so combine -d with -H:
curl -s -i -X POST "https://dummyjson.com/products/add" \
-H "Content-Type: application/json" \
-d '{"title":"Dune"}'The single quotes around the JSON stop the shell from touching the double quotes inside. The backslash at the end of a line continues the command on the next line (a Bash habit; in PowerShell the continuation character is a backtick, and in Command Prompt it is ^).
-X: choose the method
-X METHOD sets the method word. For PUT and DELETE you need it:
curl -s -X DELETE "https://dummyjson.com/products/1?select=title"Remember the warning in the manual: -X only changes the word in the request line; it does not change how curl behaves otherwise. So -X POST together with -d is fine (it just repeats what -d already implies), but -X GET will not turn a -d body into a query string. And you do not need -X GET: GET is already the default.
Quote your URLs
In many shells, & means "run the previous command in the background" and ? or * may be treated as patterns. A URL such as https://dummyjson.com/products?limit=2&select=title,price contains &, so always put the URL in quotes:
curl -s "https://dummyjson.com/products?limit=2&select=title,price"Without quotes, the shell cuts the command at &. The first part runs with only limit=2, and the rest is treated as a separate command. Use double quotes for URLs, single quotes for JSON.
Postman and curl side by side
| Postman box | curl option |
|---|---|
| Method drop-down | -X METHOD (default GET) |
| URL bar | the quoted URL |
| Headers tab | -H "Name: value" |
| Body tab (raw, JSON) | -d '{...}' |
| Response status and headers | -i |
Postman can even show you the curl equivalent of a request through its code-generation feature, and can import a pasted curl command (menu locations vary by version). That makes the two tools interchangeable.
Examples
Example 1: Simple. A GET and the status
curl -s "https://dummyjson.com/products/2?select=title,price"
curl -s -o /dev/null -w "%{http_code}\n" "https://dummyjson.com/products/2"Real output:
{"id":2,"title":"Eyeshadow Palette with Mirror","price":19.99}
200First command: the body. Second: the same request, but only the number 200 printed.
Example 2: Practical. Filtering and paging
DummyJSON documents limit and skip for paging and search for text search. All in one line each:
curl -s "https://dummyjson.com/products?limit=3&skip=10&sortBy=price&order=asc&select=title,price"
curl -s "https://dummyjson.com/products/search?q=phone&limit=2&select=title"Real output (the data can change over time):
{"products":[{"id":41,"title":"Tissue Paper Box","price":2.49},{"id":23,"title":"Eggs","price":2.99},{"id":32,"title":"Milk","price":3.49}],"total":194,"skip":10,"limit":3}
{"products":[{"id":101,"title":"Apple AirPods Max Silver"},{"id":104,"title":"Apple iPhone Charger"}],"total":23,"skip":0,"limit":2}Skipping the first ten of the price-sorted list gave the 11th to 13th cheapest products. The total field says how many products matched. Notice that the "phone" search matched an item with "Phone" in the text, which is the API's own search logic, not anything we control.
Example 3: Realistic. A full create, read-it-back test
Goal: check that creating a product answers 201, and see what the API does with the new id. We need -i for the status.
curl -s -i -X POST "https://dummyjson.com/products/add" \
-H "Content-Type: application/json" \
-d '{"title":"Dune"}'Real output (status line, then body; the long middle header block is cut):
HTTP/1.1 201 Created
...
{"id":195,"title":"Dune"}The status is 201 Created, as in Lesson 2. Now ask for that product:
curl -s -o /dev/null -w "%{http_code}\n" "https://dummyjson.com/products/195"Real output: 404. The documentation says add, update, and delete are only simulated, so nothing was stored. Also note that a DELETE on this API returned 200 with a JSON body in our test, not the 204 we described as typical in Lesson 2. Both are legal outcomes; the documentation of the API you use is the authority.
Backend Insight
Backend developers use curl constantly: to check that a freshly started server answers, to reproduce a bug a teammate reports ("run this and see 500"), and inside scripts, deployment checks, and CI jobs. A curl line pasted into a ticket is a complete, unambiguous bug report. Learn to read the -i output quickly: first the status line, then Content-Type, then the body.
Treat commands you copy with care. A curl line may send data to a server, and the options may hold secrets such as tokens. Do not paste commands containing real credentials into public places, and do not run a command from an unknown source without reading it.
Common Mistakes
- Forgetting quotes around a URL with
&. The command is cut at the&. - Using
-dwith JSON and forgetting-H "Content-Type: application/json". The default label is form data, so a JSON API may reject or misread the body. - Writing
-X GET(unneeded) or expecting-Xto change more than the method word. - Reading only the body. Without
-iyou cannot see the status. A 404 page can look like data. - Using
curlin Windows PowerShell and getting the alias. Usecurl.exe. - Smart quotes. Copying
"or'from a word processor yields curly quotes that the shell does not understand. - Assuming a practice API stores data. Check the documentation, as in Example 3.
Exercises
Level A: Foundation
- Which option adds a header? Which sends a body? Which shows the status line?
- Why is
curl https://dummyjson.com/products?limit=2&select=titlerisky in Bash? - What method does
curl URLuse when you give no options?
Level B: Application
- Run
curl -s -i "https://dummyjson.com/products/1?select=title"and write down the status line and theContent-Typeheader. - Write a command that prints only the status code for
GET /products/3. Then write the same for/products/99999. What are the two numbers? - Write a
curlcommand that sendsPOSTtohttps://dummyjson.com/products/addwith JSON{"title":"Emma"}, correct header included, and shows the status. What status do you expect?
Level C: Challenge
- Translate this Postman request into one
curlcommand: methodPUT, URLhttps://dummyjson.com/products/1, headerContent-Type: application/json, body{"title":"Updated"}. Run it. Does the server really update product 1? How can you check? - Run
curl -s -i "https://dummyjson.com/produkts"andcurl -s "https://dummyjson.com/products/99999". Both are 404s. Compare their bodies and say what that teaches you about reading the status code and the body.
أظهر الحلول
-Hadds a header,-dsends a body,-ishows the status line and headers.- The
&makes the shell split the command (in many shells it runs the first part in the background and then tries to runselect=titleas a command), so the server receives onlylimit=2. Quote the URL. GET.- Status line
HTTP/1.1 200 OKandContent-Type: application/json; charset=utf-8in our run. curl -s -o /dev/null -w "%{http_code}\n" "https://dummyjson.com/products/3"prints200, and the same with/products/99999prints404.curl -s -i -X POST "https://dummyjson.com/products/add" -H "Content-Type: application/json" -d '{"title":"Emma"}'. Expected status201 Created.curl -s -X PUT "https://dummyjson.com/products/1" -H "Content-Type: application/json" -d '{"title":"Updated"}'. The answer shows"title":"Updated", but a laterGET /products/1?select=titlestill returns the original title, because this API only simulates updates (as its documentation says).- The unknown path gives an HTML "page not found" page; the missing product gives a short JSON message (
Product with id '99999' not found). Lesson: both have status 404, but the body format differs from API to API, so always read the status first, then interpret the body based on the documentation.
Mini Challenge
Write a small file called calls.txt containing five curl lines for the DummyJSON products API: list with limit, one item, search, one deliberate wrong path, and one POST to /products/add. For each line, add a comment (a line starting with #) saying which status you expect, then run them one at a time and mark any line where the result surprised you.
Summary & Next Lesson
Key takeaways
curl URLsends aGETand prints the body only.-iadds status and headers;-shides progress;-wand-olet you print just the status.-Hadds a header,-dsends a body (and impliesPOST),-Xsets the method word.- Quote URLs that contain
&; put JSON in single quotes. - In Windows PowerShell,
curlmay be an alias: usecurl.exe. - A
curlline is a portable, copyable description of a request.
Next lesson
In "Sketching endpoints for a resource" you will stop calling other people's APIs and design your own on paper: URL, method, and status code for every action on a resource.
Self-check
- Which option shows the status line?
- What does
-Xchange, and what does it not change? - Why quote a URL that contains
&? - What does
-dimply about the method, and about the body label? - How do you print only the status code?
أظهر الإجابات
-i.- It changes the method word in the request line; it does not change the other behavior of
curl(for example it does not turn a body into a query string). - Because the shell treats
&as a command separator or background marker, so the URL is cut. - It implies
POST, and the body is labeledapplication/x-www-form-urlencodedunless you set anotherContent-Typewith-H. curl -s -o /dev/null -w "%{http_code}\n" URL.
References
- curl project, curl man page. Supports
-H,-d(POST and form-urlencoded default),-i/--show-headers,-s,-w,-I,-v, and the warning that-Xonly changes the method word. Read in parts; quoting advice for&is general shell behavior and was not taken from this page. - curl project, Everything curl: simple POST. Supports that
-dsends form-style data as aPOSTbody. - Microsoft Learn, Invoke-WebRequest (Windows PowerShell 5.1). States that
curlis an alias for this cmdlet in Windows PowerShell. - DummyJSON, Products documentation. Documents the endpoints and that add, update, and delete are simulated. All outputs were produced by running the commands in this lesson with
curl 8.6.0in Bash; headers were shortened. On the machine used, an extra option for certificate checking was needed to connect; that is a local setup issue and is not part of the lesson.
التطبيق
طبّق هذا الدرس بمختبر الوحدة وتمارينها واختبارها.
تعليم الدرس كمكتمل اختياري ويمكنك التراجع عنه في أي وقت. يبقى تقدمك محفوظًا في هذا المتصفح.