Basic forms
bash
curl https://example.com # GET, body to stdout
curl -s https://api.example/users # -s: silent (no progress bar)
curl -o out.html https://example.com # save to file
curl -O https://example.com/file.tar.gz # save with original filename
curl -X POST -d 'name=alice' https://... # POST with form data
curl -X POST -H "Content-Type: application/json" -d '{"x":1}' https://...curl -X DELETE https://api.example/u/123
Headers and authentication
bash
curl -H "Authorization: Bearer $TOKEN" https://api.example
curl -u user:pass https://api.example # basic auth
curl --cookie "session=abc" https://...
curl -A "Mozilla/5.0" https://... # User-Agent
Debug flags
bash
curl -v https://example.com # verbose: shows request + response headers
curl -I https://example.com # headers only (HEAD request; quick status check)
curl --trace-ascii - https://example.com # dump of all exchanged bytes
curl -w "@curl-format.txt" -o /dev/null -s https://example.com # timing
Format for -w:
time_namelookup: %{time_namelookup}stime_connect: %{time_connect}stime_appconnect: %{time_appconnect}s # TLS handshaketime_starttransfer: %{time_starttransfer}s # TTFBtime_total: %{time_total}sThis shows exactly where the slowdown is: dns-resolution / TCP / tls-handshake / server.
TLS
bash
curl -k https://self-signed # skip certificate verification (NOT for production!)
curl --cacert ca.pem https://... # trust a specific CA
curl --cert client.pem --key client.key # mTLS
curl --resolve example.com:443:1.2.3.4 https://example.com # DNS override
--resolve is invaluable for testing. It connects to the specified IP while sending the correct
SNI/Host header. No /etc/hosts edits needed.
Retries and timeouts
bash
curl --max-time 10 https://... # overall timeout of 10 s
curl --connect-timeout 5 https://... # TCP connect only
curl --retry 3 --retry-delay 2 https://... # auto-retry on network errors
Pipe to jq
bash
curl -s https://api.github.com/repos/torvalds/linux | jq '.stargazers_count'
The standard combination for REST debugging.