Ten curl Commands You'll Use Every Week

02 Apr 2026

You already know curl -X GET url. Here are the ten you actually reach for once you’re debugging APIs for a living.

1. See the response headers without the body

curl -I https://api.example.com/health

Fast way to check a status code or a Content-Type without pulling megabytes of JSON. If you need headers and body, use -i instead of -I.

2. Send JSON without fighting quotes

curl -X POST https://api.example.com/users \
  -H "Content-Type: application/json" \
  -d '{"name": "dev", "role": "admin"}'

On Windows or in PowerShell the quoting breaks constantly. Put the payload in a file and skip the problem entirely:

curl -X POST https://api.example.com/users \
  -H "Content-Type: application/json" \
  -d @payload.json

3. Follow redirects

curl -L https://short.link/abc

Without -L, curl prints the 301/302 response and stops. Most people find this out the hard way when a request to a bare domain silently returns nothing useful.

4. Time the request, broken down by phase

curl -w "dns: %{time_namelookup}s connect: %{time_connect}s ttfb: %{time_starttransfer}s total: %{time_total}s\n" \
  -o /dev/null -s https://api.example.com

This tells you whether a slow request is DNS, TCP handshake, TLS, or the server actually thinking. Way faster than reaching for a browser network tab.

5. Retry on failure

curl --retry 3 --retry-delay 2 --retry-connrefused https://api.example.com

Useful in deploy scripts hitting a service that’s still coming up. --retry-connrefused matters — without it, curl only retries on transient HTTP errors, not on “nothing is listening yet.”

6. Upload a file

curl -X POST https://api.example.com/upload \
  -F "file=@./report.pdf" \
  -F "description=Q3 report"

-F builds a proper multipart/form-data request. Using -d here sends the wrong content type and the server will reject it or silently drop the file.

7. Set a bearer token once, reuse it

TOKEN="eyJhbGciOi..."
curl -H "Authorization: Bearer $TOKEN" https://api.example.com/me

Trivial, but store the token in a shell variable or .netrc rather than pasting it into every command in your history. It’ll leak into ~/.bash_history otherwise.

8. Save the response with the right filename

curl -O https://example.com/releases/app-v2.1.0.tar.gz

-O uses the remote filename. -o custom-name.tar.gz overrides it. Don’t use plain redirection (> file) on a failed request — you’ll end up with an HTML error page saved as a .tar.gz.

9. Test with a specific HTTP method and check only the status code

curl -s -o /dev/null -w "%{http_code}\n" -X DELETE https://api.example.com/items/42

This is the pattern for health checks and CI smoke tests: no body noise, just the number you care about.

10. Impersonate a real client

curl -A "Mozilla/5.0" https://example.com

Some APIs and CDNs block the default curl/8.x user agent outright. Swapping it is usually enough to get past naive bot filtering during debugging — not a bypass for anything that actually checks auth.

The one flag worth memorizing today

-v (verbose) shows you the full request and response, headers included, TLS handshake and all. When something’s broken and you don’t know why, that’s where you start — before you reach for Postman or a browser.

IAnswerable