#Your first request
Ten seconds from launch to a response.
- Press CtrlN for a new request — or use the + in the tab strip.
- Choose the method, type the URL.
{{baseUrl}}/pokemon/pikachuworks once you have definedbaseUrl(see Variables). - Press CtrlEnter — or Enter while you are in the URL field — to send.
- The response appears on the right: status, time, size, and the body formatted.
#Workspaces, folders and tabs
A workspace holds folders, requests and environments. Switch between them with CtrlR or from the menu at the top of the sidebar.
- Folders group requests, can be nested, and can carry their own variables, authentication and scripts that apply to everything inside.
- Drag and drop to reorder or move a request into a folder. Dragging is switched off while a filter is active, so nothing lands in the wrong place.
- Filter the tree with the box above it, or jump straight to a request with CtrlP.
- Right-click a tab to locate it in the tree, close it, close the others or close all. CtrlW closes the active tab; CtrlShiftE searches the open ones.
- CtrlB hides and shows the sidebar.
#Building a request
Each request has a set of tabs under the URL bar:
| Tab | What it is for |
|---|---|
| Params | Query parameters. Editing a row rewrites the URL, and editing the URL updates the rows. |
| Body | None, JSON, text, XML, form, multipart or GraphQL. JSON and XML have a formatter. |
| Headers | A Content-Type matching the body type is added for you unless you set one. |
| Auth | Inherit from the folder, none, bearer token, basic, or an API key in a header or the query. |
| Scripts | Pre-request and post-response scripts — see Scripts. |
| Docs | Document the fields of a request — name, example, description, required. They go into an OpenAPI export. |
| Versions | The last 20 saved versions of this request, each one restorable. |
Set authentication once on a folder and every request inside inherits it; a request can still choose its own.
#Variables and environments
Write {{name}} anywhere — URL, headers, body, auth — and Carom fills it in when you send.
Where a value comes from
- The folder the request is in. With nested folders, the innermost one wins.
- The active environment, chosen in the picker at the top right.
- The base environment, shared by all the others.
Hover a variable to see its value and which of the three supplied it. A variable that is not defined anywhere is shown in red.
Defining and changing them
- Hover a variable, in the URL or inside a body, and edit it right there — or define it if it does not exist yet.
- Select any text, right-click, and choose Set an existing variable or New variable…. The value goes into whichever environment is selected, and your selection is replaced with the reference.
- CtrlE opens the environments drawer, a quick editor beside your request that shows the active environment and the folder’s variables. Manage environments, in the picker, opens the full dialog to add, rename, colour, copy between and delete environments.
#Generated data
Variables that are made up when the request is sent. Handy for fixtures, forms and load of realistic-looking data.
Write one between braces — {{$randomEmail}} — and it becomes a fresh value on every send. Each occurrence gets its own value, so two {{$randomFullName}} in one body are two different people. That is what sets a generator apart from a variable.
- The names match Postman’s, so a collection that used them keeps working.
- Names, cities, streets and phone numbers follow the language of the interface. Identifiers, numbers and dates have no language and never change.
- To fix the language independently — an API that validates addresses in English, read by someone working in Portuguese — set Generated data in Settings → General.
- A variable you define with the same name wins over the generator.
- A misspelt generator stays red, which is the case worth noticing.
Identifiers and timestamps 7
{{$guid}}{{$randomUUID}}{{$timestamp}}{{$isoTimestamp}}{{$randomBankAccount}}{{$randomBankAccountIban}}{{$randomCreditCardMask}}
People 9
{{$randomFirstName}}{{$randomLastName}}{{$randomFullName}}{{$randomNamePrefix}}{{$randomNameSuffix}}{{$randomJobTitle}}{{$randomJobArea}}{{$randomJobType}}{{$randomPhoneNumber}}
Internet 12
{{$randomEmail}}{{$randomExampleEmail}}{{$randomUserName}}{{$randomDomainName}}{{$randomDomainWord}}{{$randomUrl}}{{$randomProtocol}}{{$randomIP}}{{$randomIPV6}}{{$randomMACAddress}}{{$randomUserAgent}}{{$randomPassword}}
Places 7
{{$randomCity}}{{$randomCountry}}{{$randomCountryCode}}{{$randomStreetName}}{{$randomStreetAddress}}{{$randomLatitude}}{{$randomLongitude}}
Commerce 12
{{$randomCompanyName}}{{$randomCompanySuffix}}{{$randomCatchPhrase}}{{$randomDepartment}}{{$randomProduct}}{{$randomProductName}}{{$randomProductAdjective}}{{$randomProductMaterial}}{{$randomPrice}}{{$randomCurrencyCode}}{{$randomCurrencyName}}{{$randomCurrencySymbol}}
Words and colours 10
{{$randomWord}}{{$randomWords}}{{$randomLoremWord}}{{$randomLoremWords}}{{$randomLoremSentence}}{{$randomLoremParagraph}}{{$randomLoremSlug}}{{$randomColor}}{{$randomHexColor}}{{$randomAbbreviation}}
Numbers 4
{{$randomInt}}{{$randomBoolean}}{{$randomAlphaNumeric}}{{$randomDigits}}
Dates 6
{{$randomDateRecent}}{{$randomDatePast}}{{$randomDateFuture}}{{$today}}{{$tomorrow}}{{$yesterday}}
Nothing matches that.
#Scripts
JavaScript that runs before a request is sent or after its response arrives.
Put a script on a request or on a folder. A folder’s scripts wrap every request inside it: pre-request scripts run from the outermost folder inward, post-response scripts from the innermost outward.
| Call | What it does |
|---|---|
carom.get(name) | Reads a variable, including ones set earlier in the same chain. |
carom.set(name, value) | Writes a variable into the active environment once the script finishes. |
carom.header(key, value) | Adds a header to the outgoing request (pre-request only). |
carom.json() | The response body parsed as JSON, or null (post-response). |
carom.request · carom.response | The request being sent, and the response that came back. |
console.log(…) | Written to the response’s Console tab. |
// Post-response script: keep the token for the next request
const body = carom.json();
if (body && body.token) carom.set("token", body.token);
Postman’s pm object works too, including pm.test, so scripts from an imported collection run unchanged.
#Reading a response
- Pretty collapses and expands JSON; Raw is exactly what came back; Preview renders HTML.
- Highlight in body finds text and marks every match.
- Headers, Cookies and Console (script output and
pm.testresults) have their own tabs. - History keeps the last 15 responses of each request. Click one to look at it again.
- Copy the response, or save it to a file, with the buttons above the body.
- When a response arrives for a request in another tab, a toast tells you.
To hand a request to someone as a command, use Copy as curl beside the URL bar. It is written with your variables already filled in — and with generated values, if the body has any. Copy URL gives you the resolved URL.
#Importing and exporting
Import
Use Import at the bottom of the sidebar. Carom reads Carom exports, Postman collections and environments, Insomnia v4 and v5, OpenAPI / Swagger, HAR files and pasted curl commands. For Postman you choose what to bring in and where it goes, environments included. Anything that does not come across — an Insomnia gRPC request, say — is listed before you confirm.
Export
Use Export for a workspace, a folder (with its subfolders and requests) or a single request, in Carom’s format or as OpenAPI 3.1. Choose the slice — environments included — and where to save it.
#Keyboard shortcuts
The defaults. Every one can be changed under Settings → General → Keyboard shortcuts.
| Action | Shortcut |
|---|---|
| Search everything | CtrlK |
| Go to a request | CtrlP |
| Switch workspace | CtrlR |
| Run a command | CtrlShiftP |
| Send the active request | CtrlEnter |
| New request | CtrlN |
| Save the active request | CtrlS |
| Search the open tabs | CtrlShiftE |
| Close the active tab | CtrlW |
| Edit environments | CtrlE |
| Show or hide the sidebar | CtrlB |
| Open settings | Ctrl, |
In the code editors
| Key | What it does |
|---|---|
| Tab · ShiftTab | Indent and outdent by two spaces. |
Typing { [ or " | Adds the closing one and puts the cursor between. In XML, < closes too. |
| Select, then type an opener | Wraps the selection instead of replacing it. |
| Typing a closer | Steps over one that is already there. |
| Backspace between a pair | Deletes both. |
| Enter in the URL field | Sends the request. |
#Themes, colours and language
- Settings → General: the interface language (English, Português, Español — it follows your system until you choose), the language of generated data, pane layout, timeout, redirects, whether the desktop app asks servers for compressed responses, and Keyboard shortcuts.
- Settings → Theme: dark or light, five built-in palettes (Carom, Midnight, Ember, Forest, Paper), and fonts with their size. Change any colour of a built-in palette and it becomes your own copy; Surprise me shuffles a new one.
- On the desktop, Settings → General → Updates checks for a new version, and lets you choose whether Carom checks by itself when it starts.
#When something is off
| Symptom | Why, and what to do |
|---|---|
| macOS says it cannot verify Carom | Expected: the app is not signed with a paid certificate. Run xattr -cr /Applications/Carom.app once, or use Open Anyway in System Settings → Privacy & Security. |
| Windows says it protected your PC | SmartScreen, for the same reason. More info → Run anyway. |
| A request fails in the browser build but not in the app | A browser enforces CORS and cannot reach localhost. The desktop app has neither limit. |
| A variable shows in red | It is not defined in the folder, the active environment or the base. Hover it to define it, or check the environment picker. |
Installed from .deb or .rpm and there is no update button | Those belong to your package manager. Carom links to the release page instead. |
| Linked folder says it changed on disk | Something — usually git pull — moved it. Reload from disk; your edits since are the ones to check. |
Found something else? Open an issue and say what you did, what you expected and what happened.