Where your data lives
ApiWorkbench keeps everything on your device, as plain JSON files in one folder. There is no account and no cloud sync. This page shows where the folder is, what is in it, and how to back it up.
The data folder
| Platform and package | Folder |
|---|---|
Linux, .deb or tarball | ~/.local/share/com.dhivalabs.api_workbench/apiworkbench/ |
| Linux, Snap | ~/snap/apiworkbench/current/.local/share/com.dhivalabs.api_workbench/apiworkbench/ |
| Windows, zip | %APPDATA%\Dhiva Labs\ApiWorkbench\apiworkbench\ |
| Windows, Microsoft Store | The app's private package storage. |
| Android | The app's private storage. Other apps and file managers cannot open it. |
On Linux, ~ is your home folder. On Windows, paste the path into the address bar of File Explorer.
What is in it
| File | Contents |
|---|---|
collections.json | Collections, folders and requests: URLs, headers, bodies, auth settings, scripts, tests, captures and saved examples. |
environments.json | Environments with their variables, and which one is active. |
globals.json | The Globals variables. |
history.json | The last 100 requests you sent, with status, duration and time. Response bodies are not kept. |
settings.json | App settings, including the proxy login, certificate passphrases and Chaos Mode sound rules. |
cookies.json | The cookie jar. |
history-….json | Earlier versions of each collection, up to 50 per collection, for version history. |
sounds/ and sounds.json | Sound clips you imported for Chaos Mode. |
OAuth 2.0 tokens that a sign-in returns are stored with the request, folder or collection that uses them, so they are in collections.json.
Some things are stored as a path to a file, not as a copy: binary bodies, form-data file fields, CA and client certificates, and .proto files. If you move those files, the request can no longer find them. On a phone, certificate files you pick are copied into the app's own storage.
Temporary files
- A load test that records its call log writes it to an
apiworkbench-loadfolder in your system's temporary folder. It is deleted when the next run starts or the load tester closes. - HTTP/3 requests on Linux and Windows pass through temporary files for the
curlprogram. They are deleted after each request.
Nothing is encrypted
DANGER
The data files are plain text. Tokens, passwords, cookies, the proxy password and certificate passphrases can be read by anyone who can open your user account's files.
Marking a variable as secret hides its value on screen, in the Console, in docs and in reports. It does not encrypt the value on disk.
Protect the files the way you protect your other files: a password on your user account, and disk encryption on a laptop. Do not put the data folder in a shared or synced location without thinking about who can read it.
Back up your work
The portable way: export the workspace
Select Export on the icon rail.
Choose ApiWorkbench workspace.
Turn on Include current values if the backup should also hold the values that scripts and captures wrote.
Select Export and save the file somewhere safe.
A workspace file holds every collection, environment and global. It does not hold settings, cookies, request history or collection version history. To restore it, or to move to another computer, import the file. See Export and share.
The complete way: copy the folder
To keep everything, including settings, cookies and history, close ApiWorkbench and copy the whole data folder. To restore, close the app and put the folder back in the same place.
This works on Linux and on Windows with the zip package. On Android and with the Microsoft Store package, use the workspace export.
WARNING
Close the app before you copy or replace the folder. The app writes these files while it runs, and a copy taken at the wrong moment can be incomplete.
If a data file is damaged and cannot be read, the app starts with that part empty instead of failing to start, and your next change overwrites the damaged file. Keep a backup if your collections matter.
Start fresh
To reset the app, close it and delete the data folder. The next start creates a new, empty one. This removes all collections, environments, cookies, history and settings on that device, and it cannot be undone without a backup.
Uninstalling works differently per platform:
- Removing the Snap, the Microsoft Store package or the Android app removes the app's data with it.
- Removing the
.deb, the tarball or the Windows zip leaves the data folder in place. Delete it yourself if you want it gone.
Files you export
Workspace exports, Postman and OpenAPI files, collection docs, saved response bodies and load test reports are written only where you choose to save them. The app does not keep a second copy.
What the app sends over the network
ApiWorkbench has no accounts, analytics, telemetry, advertising or crash reporting, and it does not check for updates. All network traffic is started by you:
- Requests, collection runs and load tests go to the URLs you enter, with the headers, bodies and credentials you set.
- Scripts can send requests with
pm.sendRequest, to the addresses the script names. They run only when you send a request or run a collection. Scripts in collections you imported from others run the same way, so read them before you send. - OAuth 2.0 sign-in opens the provider's page in your browser and listens briefly on
127.0.0.1, your own computer, for the redirect back. - WebSocket, Socket.IO, MQTT, Server-Sent Events and gRPC connections go to the addresses you enter and stay open until you disconnect.
- Importing a Chaos Mode clip from a URL downloads that page and the audio file from the address you give.
Nothing is sent to Dhiva Labs. The full policy is in PRIVACY.md in the app's repository.