Learn by changing one thing
Try a small web experiment, inspect the result, then use the guides to understand why it worked.
Change the starter page, then update the preview. Start with a heading, a paragraph and a list. Try the phone-width view before adding more styles.
Common text, layout, table and form-display elements are rebuilt inside a sandbox. Scripts, event handlers, URL attributes, images, embedded pages and external resources are removed or blocked. Links do not navigate and form controls do not submit. This is a constrained markup exercise, not a full browser IDE or a test of your site’s security.
The combined HTML and CSS limit is 50,000 characters. Learn how to check structure and keyboard behaviour in your first page checklist.
Format a response, remove unnecessary whitespace or select one value with a JSON Pointer. Use /lessons/0/title on the example to read the first lesson’s title.
This tool uses JavaScript’s JSON parser. Duplicate object keys keep their last value, and large numbers can lose precision. Keep exact identifiers as strings. Formatting is not schema validation. The input limit is 200 KB, with at most 100 nesting levels and 20,000 values.
JSON Pointer escapes / as ~1 and ~ as ~0. It does not support JSONPath filters. Read the JSON Pointer specification or practise with the API contract guide.
This is a local simulation. It uses three sample lessons. No request is sent, no account is created and writes are not saved. Change a request or force a failure to see the response a client might need to handle.
A template only. example.invalid is a reserved placeholder; replace it with your own compatible API. This code is displayed, never executed here.
GET /lessons/99. A missing resource returns 404.POST /lessons with {"title":""}. Valid JSON can still fail field validation with 422.The fixture also covers invalid JSON (400), unsupported methods (405) and a list limit from 1 to 3. Real APIs may choose different status codes and require authentication, CORS configuration, timeouts and durable storage. Use the testing guide to turn these cases into checks.
A public endpoint, a free trial and permission for commercial use are different things. These eight services are starting points for small projects, with links to their own documentation. Access conditions checked November 7, 2026; confirm current terms before you integrate.
8 services.
Weather
Non-commercial free access; commercial subscription
Useful for a forecast prototype. The free hosted service is restricted to non-commercial use; a commercial or advertising-supported product needs to check the paid service terms. Data attribution and permission to use a hosted endpoint are separate requirements. This directory does not call the API.
Project idea: Sketch a forecast card with saved example data before choosing a service plan.
Space and public data
Developer key; endpoint-specific limits
A collection of services rather than one uniform dataset. DEMO_KEY has small shared IP-based limits. Register your own key for a project, read the endpoint documentation and check image credits and usage rights before publishing media. A key does not make every item public domain.
Project idea: Build an astronomy reading list that preserves each item’s source and credit.
Public data
Public indicators API
Version 2 provides country and indicator data with pagination and JSON responses. Preserve dates, units and source metadata. A missing observation is not zero, and different indicators need not cover the same years. Check the licence attached to the dataset you choose.
Project idea: Compare one indicator across two countries using the same available year.
Books and search
Public read endpoints; low-volume usage policy
Good for book discovery and catalogue experiments. The service asks clients to identify themselves, cache results and respect rate limits. Its APIs are intended for low-volume, human-facing requests. Bulk downloads belong on the documented data-dump route; do not build a high-traffic backend by repeatedly querying the public API.
Project idea: Make a small reading list that handles a missing author or cover gracefully.
Practice and testing
Free fake REST API
Suitable for learning request methods and response handling without an account. Create, update and delete operations are simulated: a successful response does not mean a later request will contain your change. Use dummy content and distinguish this behaviour from a persistent application backend.
Project idea: Test loading, success and error states in a small post reader.
Images and layout
Public placeholder-image endpoints
Width, height, fixed IDs and seeded routes help you test an image layout. A random placeholder can change, so use a stable route when comparing designs. Follow the source-image links and check usage rights before turning a temporary image into published editorial content. Public access is not an uptime guarantee.
Project idea: Test a responsive gallery with consistent image dimensions.
Security
Free Pwned Passwords; subscription for authenticated breach searches
The password hash-range service and the email-breach search API have different access requirements. Authenticated breach searches require a subscription key. Password checks use a documented hash-prefix design; never send a plaintext password to an improvised endpoint. This lab does not collect passwords or email addresses.
Project idea: Read the hash-range design and model its response using synthetic data.
Maps and geocoding
Limited public geocoding service
The public server has an application-wide maximum of one request per second, identification and attribution requirements, and restrictions on bulk work and client-side autocomplete. Open map data does not mean unlimited use of a public server. Read the policy before choosing a provider or hosting your own service.
Project idea: Design a manually submitted place search with caching and visible attribution.
Before choosing a provider, check authentication, quotas, attribution, allowed use, error behaviour and what happens when the service is unavailable. The API terms checklist walks through that decision.
You do not need to learn every framework on a roadmap before making something useful. Start with the page, define the data it needs, then test and deploy a small working version.
Build a readable workshop page with semantic HTML, flexible CSS and keyboard checks, then test a small change in the Developer Lab.
Define requests, responses and failure states for a lesson service, then explore the same ideas in a simulated HTTP workbench.
Use books, physical copies and loans to learn keys, constraints and transactions before adding more tables to a first SQL project.
Turn a reading-list feature into a small set of meaningful tests, including empty input, server failure and a reliable retry path.
Prepare a small event app for deployment by separating configuration, protecting credentials and rehearsing a rollback in a test environment.
Use a repair-booking app to compare deployment boundaries, data ownership and failure handling before splitting a small backend into services.
Audit a fictional support-ticket dataset for missing values, duplicate records and target leakage before trusting a model score.
Check use rights, quotas, authentication and browser access before building a weather widget around an API advertised as free.
The lab processes editor input locally. It does not deliberately upload your code or JSON, save it to local storage, run analytics, or call the listed APIs. Normal page requests still reach our server and may be logged. Your browser may restore form values; use sample data rather than passwords, private records or API keys. Following a documentation link opens that provider’s website under its own privacy terms.
Found an incorrect example or outdated API condition? Report it with the workspace name and a non-sensitive example.