hurl(1)

📦

version 8.1.0 · 3 versions

8.1.0 · arch rolling (latest)
7.1.0 · nixos 26.05
8.0.1 · nixpkgs unstable

💅 hurl(1) · Hurl Manual 💅

🌸 NAME 🌸

hurl — run and test HTTP requests.

🦋 SYNOPSIS 🦋

hurl [OPTIONS] [FILES...]

hurl --test [OPTIONS] [FILES...]

✨ DESCRIPTION ✨

okay so Hurl is a command line tool that runs HTTP requests defined in a simple plain text format.

It can chain requests, capture values, and evaluate queries on headers and body response. Hurl is super versatile — it can fetch data and test HTTP sessions: HTML content, REST / SOAP / GraphQL APIs, or any other XML / JSON based APIs. slay.

$ hurl session.hurl

If no input files are specified, input is read from stdin.

$ echo GET http://httpbin.org/get | hurl
    {
      "args": {},
      "headers": {
        "Accept": "*/*",
        "Accept-Encoding": "gzip",
        "Content-Length": "0",
        "Host": "httpbin.org",
        "User-Agent": "hurl/0.99.10",
        "X-Amzn-Trace-Id": "Root=1-5eedf4c7-520814d64e2f9249ea44e0"
      },
      "origin": "1.2.3.4",
      "url": "http://httpbin.org/get"
    }

Hurl can take files as input, or directories. In the latter case, Hurl will search files with .hurl extension recursively.

Output goes to stdout by default. To have output go to a file, use the -o, --output option:

$ hurl -o output input.hurl

By default, Hurl executes all HTTP requests and outputs the response body of the last HTTP call.

To have a test oriented output, you can use --test option:

$ hurl --test *.hurl

💖 HURL FILE FORMAT 💖

The Hurl file format is fully documented in https://hurl.dev/docs/hurl-file.html.

It consists of one or several HTTP requests:

GET http://example.org/endpoint1
GET http://example.org/endpoint2

🎀 Capturing values 🎀

A value from an HTTP response can be re-used for successive HTTP requests.

A typical example occurs with CSRF tokens.

GET https://example.org
HTTP 200
# Capture the CSRF token value from html body.
[Captures]
csrf_token: xpath "normalize-
space(//meta[@name='_csrf_token']/@content)"

# Do the login !
POST https://example.org/login?user=toto&password=1234
X-CSRF-TOKEN: {{csrf_token}}

More information on captures can be found here https://hurl.dev/docs/capturing-response.html.

🎀 Asserts 🎀

The HTTP responses defined in the Hurl file are what Hurl uses to make asserts. Responses are optional.

At the minimum, a response includes an assert on the HTTP status code:

GET http://example.org
HTTP 301

It can also include asserts on the response headers:

GET http://example.org
HTTP 301
Location: http://www.example.org

Explicit asserts can be included by combining a query and a predicate:

GET http://example.org
HTTP 301
[Asserts]
xpath "string(//title)" == "301 Moved"

With the addition of asserts, Hurl can be used as a testing tool to run scenarios.

More information on asserts can be found here https://hurl.dev/docs/asserting-response.html.

🌈 CONFIGURATION 🌈

Options that exist in curl have exactly the same semantics.

Options specified on the command line are defined for every Hurl file’s entry, except if they are tagged as cli-only (can not be defined in the Hurl request [Options] entry).

For instance:

$ hurl --location foo.hurl

will follow redirection for each entry in foo.hurl. You can also define an option only for a particular entry with an [Options] section. For instance, this Hurl file:

GET https://example.org
HTTP 301

GET https://example.org
[Options]
location: true
HTTP 200

will follow a redirection only for the second entry.

Hurl also looks for a configuration file at these spots: $XDG_CONFIG_HOME/hurl/config if $XDG_CONFIG_HOME exists, or $HOME/.config/hurl/config. The configuration file is a list of options added to each Hurl run.

$ cat ~/.config/hurl/config
# Hurl config file
--header x-identifier:quux
--verbose
--delay=1s
--fail-with-body

Most of the options can also be defined with environment variables (like HURL_INSECURE for --insecure). So, in order to configure Hurl, there are four sources from the lowest priority to highest (overrides all others):

Configuration file (ex: ~/.config/hurl/config)
Environment variables (ex: export HURL_INSECURE=true)
Command-line options (ex: hurl --insecure)
Options section options (ex: insecure: true in file)

👑 ALL OPTIONS 👑

🔥 HTTP options 🔥

--aws-sigv4 <PROVIDER1[:PROVIDER2[:REGION[:SERVICE]]]> — Generate an Authorization header with an AWS SigV4 signature. Use -u, --user to specify Access Key Id (username) and Secret Key (password). To use temporary session credentials (e.g. for an AWS IAM Role), add the X-Amz-Security-Token header containing the session token.
--cacert <FILE> — Specifies the certificate file for peer verification. The file may contain multiple CA certificates and must be in PEM format. Normally Hurl is built to use a default file for this, so this option is typically used to alter that default file.
-E, --cert <CERTIFICATE[:PASSWORD]> — Client certificate file and password. See also --key.
--compressed — Request a compressed response using one of the algorithms br, gzip, deflate and automatically decompress the content. Environment variables: HURL_COMPRESSED.
--connect-timeout <SECONDS> — Maximum time in seconds that you allow Hurl’s connection to take. You can specify time units in the connect timeout expression. Set Hurl to use a connect timeout of 20 seconds with --connect-timeout 20s or set it to 35,000 milliseconds with --connect-timeout 35000ms. No spaces allowed. See also -m, --max-time. Environment variables: HURL_CONNECT_TIMEOUT.
--connect-to <HOST1:PORT1:HOST2:PORT2> — For a request to the given HOST1:PORT1 pair, connect to HOST2:PORT2 instead. This option can be used several times in a command line. See also --resolve.
--digest — Tell Hurl to use HTTP Digest authentication.
-H, --header <NAME:VALUE> — Add an extra header to include in information sent. Can be used several times in a command. Do not add newlines or carriage returns. Environment variables: HURL_HEADER='name1:value1|name2:value2' (headers are separated by |).
-0, --http1.0 — Tells Hurl to use HTTP version 1.0 instead of using its internally preferred HTTP version. Environment variables: HURL_HTTP10.
--http1.1 — Tells Hurl to use HTTP version 1.1. Environment variables: HURL_HTTP11.
--http2 — Tells Hurl to use HTTP version 2. For HTTPS, this means Hurl negotiates HTTP/2 in the TLS handshake. Hurl does this by default. For HTTP, this means Hurl attempts to upgrade the request to HTTP/2 using the Upgrade: request header. Environment variables: HURL_HTTP2.
--http2-prior-knowledge — Tells Hurl to issue a non-TLS HTTP request using HTTP/2 directly without HTTP/1.1 Upgrade. It requires prior knowledge that the server supports HTTP/2 straight away. HTTPS requests still do HTTP/2 the standard way with negotiated protocol versions in the TLS handshake. Environment variables: HURL_HTTP2_PRIOR_KNOWLEDGE.
--http3 — Tells Hurl to try HTTP version 3 to the host in the URL, but fallback to earlier HTTP versions if the HTTP/3 connection establishment fails. HTTP/3 is only available for HTTPS and not for HTTP URLs. Environment variables: HURL_HTTP3.
-k, --insecure — This option explicitly allows Hurl to perform "insecure" SSL connections and transfers. Environment variables: HURL_INSECURE.
-4, --ipv4 — This option tells Hurl to use IPv4 addresses only when resolving host names, and not for example try IPv6. Environment variables: HURL_IPV4.
-6, --ipv6 — This option tells Hurl to use IPv6 addresses only when resolving host names, and not for example try IPv4. Environment variables: HURL_IPV6.
--key <KEY> — Private key file name.
--limit-rate <SPEED> — Specify the maximum transfer rate you want Hurl to use, for both downloads and uploads. This feature is useful if you have a limited pipe and you would like your transfer not to use your entire bandwidth. To make it slower than it otherwise would be. The given speed is measured in bytes/second. Environment variables: HURL_LIMIT_RATE.
-L, --location — Follow redirect. To limit the amount of redirects to follow use the --max-redirs option. Environment variables: HURL_LOCATION.
--location-trusted — Like -L, --location, but allows sending the name + password to all hosts that the site may redirect to. This may or may not introduce a security breach if the site redirects you to a site to which you send your authentication info (which is plaintext in the case of HTTP Basic authentication). Environment variables: HURL_LOCATION_TRUSTED.
--max-filesize <BYTES> — Specify the maximum size in bytes of a file to download. If the file requested is larger than this value, the transfer does not start. Environment variables: HURL_MAX_FILESIZE. This is a cli-only option.
--max-redirs <NUM> — Set maximum number of redirection-followings allowed. By default, the limit is set to 50 redirections. Set this option to -1 to make it unlimited. Environment variables: HURL_MAX_REDIRS.
-m, --max-time <SECONDS> — Maximum time in seconds that you allow a request/response to take. This is the standard timeout. You can specify time units in the maximum time expression. Set Hurl to use a maximum time of 20 seconds with --max-time 20s or set it to 35,000 milliseconds with --max-time 35000ms. No spaces allowed. See also --connect-timeout. Environment variables: HURL_MAX_TIME.
--negotiate — Tell Hurl to use Negotiate (SPNEGO) authentication.
--no-cookie-store — the page gives no description for this one, so we’re not inventing anything 👀.
--no-cookie-store — bestie, this one says no cookies for you 🍪🙅‍♀️. It kills cookie storage for the requests/responses inside a file. By default, all the requests in the same Hurl file share cookie storage — this option deactivates the cookie engine entirely.

Environment variables: HURL_NO_COOKIE_STORE

This is a cli-only option.

--no-header <NAME> — yeets a header out of the info being sent 🗑️. You can stack it, use it several times in one command, no problem.

Environment variables: HURL_NO_HEADER='name1|name2' (the names are separated by |)

--no-proxy <HOST(S)> — a comma-separated list of hosts that do not go through a proxy 🚫.

Environment variables: no_proxy

This is a cli-only option.

--ntlm — tells Hurl to use NTLM authentication 🔐.
--path-as-is — tells Hurl to not mess with sequences of /../ or /./ in the given URL path. Normally Hurl squashes or merges them according to standards, but with this option you're literally telling it to leave them alone 🙈.
--pinnedpubkey <HASHES> — okay so when negotiating a TLS or SSL connection, the server sends a certificate saying "this is me 💁‍♀️". A public key gets extracted from that certificate, and if it doesn't exactly match the public key you handed to this option, Hurl aborts the connection before sending or receiving any data. Zero data exchanged, periodt 🔥.
-x, --proxy <[PROTOCOL://]HOST[:PORT]> — use the specified proxy 🛰️.

Environment variables: http_proxy https_proxy all_proxy

--proxy-header <HEADER> — an extra header to include in the request when it's being sent to a proxy 🎀. These headers are only applied when a proxy is involved; if Hurl connects directly to the target server, they're ignored. Rude but true.

Environment variables: HURL_PROXY_HEADER='name1:value1|name2:value2' (headers are separated by |)

This is a cli-only option.

--resolve <HOST:PORT:ADDR> — gives you a custom address for a specific host + port pair 💅. Using this, you can make the Hurl request(s) use the address you picked and stop the normally-resolved address from being used. Think of it as a little /etc/hosts alternative right there on the command line, iykyk.
--ssl-no-revoke — (Windows 🪟) this tells Hurl to disable certificate revocation checks.

⚠️ WARNING: this option loosens the SSL security, and by using this flag you are asking for exactly that. No cap, it's less safe.

This is a cli-only option.

--tls-max <VERSION> — sets the maximum allowed TLS version 🧚. If the connection is done without TLS, this option has no effect — and yes, that includes QUIC-using (HTTP/3) transfers.
- default — Use up to the recommended TLS version.
- 1.0 — Use up to TLSv1.0.
- 1.1 — Use up to TLSv1.1.
- 1.2 — Use up to TLSv1.2.
- 1.3 — Use up to TLSv1.3.

Environment variables: HURL_TLS_MAX

--tls-min <VERSION> — sets the minimum allowed TLS version 🌸. Same deal — if the connection is done without TLS, this option has no effect, and that includes QUIC-using (HTTP/3) transfers.
- default — Use down to the recommended TLS version.
- 1.0 — Use down to TLSv1.0.
- 1.1 — Use down to TLSv1.1.
- 1.2 — Use down to TLSv1.2.
- 1.3 — Use down to TLSv1.3.

Environment variables: HURL_TLS_MIN

--unix-socket <PATH> — (HTTP) connect through this Unix domain socket instead of using the network 🔌.
-u, --user <USER:PASSWORD> — adds a basic Authentication header to each request 🔑.

Environment variables: HURL_USER

-A, --user-agent <NAME> — specifies the User-Agent string to send to the HTTP server 🕵️‍♀️.

Environment variables: HURL_USER_AGENT

This is a cli-only option.

🎀 Output options 🎀

--color — colorizes standard output and standard error 🌈.

By default, Hurl outputs a prettified and colorized response. But when redirected through pipes, the standard streams are not colorized — so this option forces the color back on. Slay.

Environment variables: HURL_COLOR

This is a cli-only option.

--curl <FILE> — exports each request to a list of curl commands 📝. Iconic for when you need to hand a repro to someone.

This is a cli-only option.

--error-format <FORMAT> — controls the format of the error message (short by default, or long) 😭. When using long, the response body is logged whenever there are errors.

Environment variables: HURL_ERROR_FORMAT

This is a cli-only option.

--fail-with-body — outputs the body response on standard output if there are any errors 💀. By default, Hurl only outputs the last body response on standard output when a run is successful. So like… this is the "show me the damage anyway" button.

Environment variables: HURL_FAIL_WITH_BODY

-i, --include — includes the HTTP headers in the output 📋.

This is a cli-only option.

--json — outputs each Hurl file result to JSON ✨. The format is very close to HAR format.

This is a cli-only option.

--no-color — do not colorize standard output nor standard error 🚫🌈.

Environment variables: HURL_NO_COLOR NO_COLOR

This is a cli-only option.

--no-output — suppresses output entirely 🤐. By default, Hurl outputs the body of the last response.

Environment variables: HURL_NO_OUTPUT

This is a cli-only option.

--no-pretty — do not prettify response output for supported content types (JSON only for the moment 🙃). By default, output is prettified if standard output is a terminal.

Environment variables: HURL_NO_PRETTY

This is a cli-only option.

-o, --output <FILE> — writes output to FILE instead of stdout 📁. Use '-' for stdout in [Options] sections.
--pretty — prettifies response output for supported content types (JSON only for the moment 💖). By default, a JSON response is prettified if standard output is a terminal, and colorized — see --no-color to format without color.

Environment variables: HURL_PRETTY

This is a cli-only option.

--progress-bar — displays a progress bar in test mode 📊. The progress bar is displayed only in interactive TTYs, and this option forces it to show up even in non-interactive TTYs.

This is a cli-only option.

-v, --verbose — turns on verbose output on the standard error stream 🗣️. Super useful for debugging.

A line starting with '>' means data sent by Hurl. A line starting with '<' means data received by Hurl. A line starting with '*' means additional info provided by Hurl.

If you only want HTTP headers in the output, -i, --include might be the option you're looking for 👀.

Environment variables: HURL_VERBOSE

--verbosity <LEVEL> — sets the verbosity level for debug logs on the standard error stream (brief, verbose or debug) 🔍.

If you only want HTTP headers in the output, -i, --include might be the option you're looking for. -v, --verbose is an alias for --verbosity verbose, and --very-verbose is an alias for --verbosity debug.

Environment variables: HURL_VERBOSITY

--very-verbose — turns on more verbose output on the standard error stream 🫣.

In contrast to the --verbose option, this option outputs the full HTTP body request and response on standard error. In addition, lines starting with '**' are libcurl debug logs. It's giving maximal chaos and I love it.

Environment variables: HURL_VERY_VERBOSE

👑 Run options 👑

--continue-on-error — keeps executing requests all the way to the end of the Hurl file even when an assert error occurs 🏃‍♀️💨. By default, Hurl exits after an assert error in the HTTP response.

Note that this option does not affect the behavior with multiple input Hurl files 📚.

All the input files are executed independently. The result of one file does not affect the execution of the other Hurl files.

Environment variables: HURL_CONTINUE_ON_ERROR

This is a cli-only option.

--delay <MILLISECONDS> — sets a delay before each request (aka sleep 😴). The delay is not applied to requests that have been retried because of --retry — see --retry-interval to space out retried requests.

You can specify time units in the delay expression, bestie ✨. Set Hurl to use a delay of 2 seconds with --delay 2s or set it to 500 milliseconds with --delay 500ms. Supported time units: ms, s, m, h. No spaces allowed 🚫.

Environment variables: HURL_DELAY

--from-entry <ENTRY_NUMBER> — executes the Hurl file starting from ENTRY_NUMBER (counting starts at 1) 🔢.

This is a cli-only option.

--jobs <NUM> — the maximum number of parallel jobs in parallel mode 🧑‍🤝‍🧑. The default value corresponds (in most cases) to the current amount of CPUs. Set it to 1 to disable parallel execution of files.

🎀 Report options 🎀

--report-html <DIR> — generates an HTML report in DIR 🌈 if the HTML report already exists, it gets updated with the new test results. no deleting, just vibes.
- cli-only option ✨
--report-json <DIR> — generates a JSON report in DIR 🦋 if the JSON report already exists, it gets updated with the new test results.
- cli-only option ✨
--report-junit <FILE> — generates a JUnit file 👑 if the FILE report already exists, it gets updated with the new test results.
- cli-only option ✨
--report-tap <FILE> — generates a TAP report 💅 if the FILE report already exists, it gets updated with the new test results.
- cli-only option ✨

🍓 Other options 🍓

-b, --cookie <FILE> — reads cookies from FILE (Netscape cookie file format, the classic 🍪). combine it with -c, --cookie-jar and you can simulate a whole cookie storage between successive Hurl runs. main character cookie behaviour.
- cli-only option 💜
-c, --cookie-jar <FILE> — writes cookies to FILE after the session runs, using the Netscape cookie file format 🍪 combine it with -b, --cookie and you can simulate a cookie storage between successive Hurl runs.
- cli-only option 💜
--file-root <DIR> — sets the root directory for importing files in Hurl 📁 this covers files in multipart form data, request body and response output. if you don't define it explicitly, files are relative to the Hurl file's directory.
- cli-only option 🌸
--glob <GLOB> — specifies input files matching the given glob pattern ✨ multiple glob flags are allowed. it supports common Unix glob patterns like *, ? and [].

⚠️ real talk: so your shell doesn't expand glob patterns before Hurl gets to handle them, you must wrap each pattern in single quotes or double quotes. don't let bash steal your moment 💀

cli-only option 🦋

-n, --netrc — scans the .netrc file in the user's home directory for the username and password 🔐
- See also --netrc-file and --netrc-optional.
--netrc-file <FILE> — like --netrc, but you provide the path to the netrc file yourself 🫶
- See also --netrc-optional.
--netrc-optional — similar to --netrc, but makes the .netrc usage optional 🌈
- See also --netrc-file.
-h, --help — usage help 🥺 lists all current command line options with a short description.
-V, --version — prints version information 👑

💀 EXIT CODES 💀

0 — success 🎉 slay.
1 — failed to parse command-line options 😭
2 — input file parsing error 🙈
3 — runtime error (such as failure to connect to host) 💀
4 — assert error 🔥

🌈 WWW 🌈

https://hurl.dev

⭐ SEE ALSO ⭐

curl(1) hurlfmt(1)

and that's the whole page bestie, you ate it 💅 this was hurl 8.1.0, dated 27 Oct 2026 — go be iconic with it 🎀✨🦋

📦 where this page comes from

arch rolling: hurl 8.1.0-1 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms