All cheat sheets

curl Cheat Sheet

curl flags and patterns: methods, headers, auth, data, cookies, and common API calls.

CLI & Shell
curl
http
cli

curl transfers data using URLs and is especially useful for testing HTTP APIs from a terminal. Start with a simple request, then add only the flags needed for headers, data, authentication, or diagnostics.

Basic requests and flags

A URL alone performs a GET and writes the response body to standard output. Use --fail-with-body in scripts when HTTP errors should produce a non-zero exit status while retaining the response.

bash
curl https://api.example.com/health
curl --fail-with-body --silent --show-error https://api.example.com/health
Table
FlagUse
-X, --request METHODSelect an HTTP method explicitly.
-H, --header NAME: VALUEAdd a request header.
-d, --data DATASend request data; commonly changes the method to POST.
-o, --output FILEWrite the response to a named file.
-i, --includeInclude response headers in output.
-L, --locationFollow redirects.
-s, --silentHide progress and errors.
-S, --show-errorShow errors when silent mode is enabled.
-v, --verboseShow request and connection details.
-u, --user USER:PASSWORDSend Basic authentication credentials.
-F, --form NAME=VALUEBuild a multipart form request.
-w, --write-out FORMATPrint selected transfer metadata.

HTTP methods

Use explicit methods when the server contract requires them. A request body is usually supplied with --data, --json, or --form.

bash
curl -X GET https://api.example.com/items
curl -X POST https://api.example.com/items
curl -X PUT https://api.example.com/items/42
curl -X PATCH https://api.example.com/items/42
curl -X DELETE https://api.example.com/items/42
Table
MethodCommon intent
GETRetrieve a representation.
POSTCreate a resource or trigger an action.
PUTReplace a resource representation.
PATCHApply a partial update.
DELETERemove a resource.

Headers and JSON

Headers describe the request and its payload. Modern curl versions support --json, which adds JSON content and accept headers; the expanded form is useful when compatibility matters.

bash
curl https://api.example.com/items \
  -H 'Accept: application/json'
bash
curl https://api.example.com/items \
  -X POST \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  --data '{"name":"Ada","active":true}'
bash
curl --json '{"name":"Ada"}' https://api.example.com/items
curl --json @payload.json https://api.example.com/items

Authentication and cookies

Avoid putting secrets in shell history when possible. Use environment variables, a credential helper, or a protected config file instead of hard-coding tokens.

bash
curl -u "$API_USER:$API_PASSWORD" https://api.example.com/private
curl https://api.example.com/private \
  -H "Authorization: Bearer $API_TOKEN"
bash
curl -c cookies.txt -X POST https://api.example.com/login \
  --data 'user=ada&password=secret'
curl -b cookies.txt https://api.example.com/account
Table
OptionMeaning
-b FILERead cookies from a file.
-c FILEWrite received cookies to a file.
--cookie 'name=value'Send one cookie directly.
-u user:passHTTP Basic authentication.

Downloads and forms

-O uses the remote filename; -o chooses one. Use -L when a download URL redirects to a final location.

bash
curl -L -O https://downloads.example.com/archive.tar.gz
curl -L -o latest.tar.gz https://downloads.example.com/archive.tar.gz
curl -F 'file=@report.pdf' -F 'description=Quarterly report' https://api.example.com/upload

Inspect responses

--write-out is useful for scripts and smoke tests because it can emit a stable status code or timing value after the body.

bash
curl -sS -o /dev/null -w 'status=%{http_code}\ntime=%{time_total}s\n' \
  https://api.example.com/health
bash
curl -i -v https://api.example.com/health

References

Related tools

curl to Code ConverterHTTP Request Builder