About this conversion
In this example, the cURL command with a Bearer token is translated into an Apex HttpRequest object. We use `req.setEndpoint()`, `req.setMethod('POST')`, and `req.setHeader('Authorization', 'Bearer ...')`.
Key Syntax Transformations
The HttpRequest builder chain
Every conversion follows the canonical callout shape: HttpRequest req = new HttpRequest();, then req.setEndpoint(), req.setMethod('POST'), and one req.setHeader() per -H flag — in the same order curl sends them.
Bodies via req.setBody()
JSON payloads are compacted to a single line and escaped into a single-quoted Apex string literal, so the snippet pastes cleanly into the Developer Console's Execute Anonymous window.
Basic auth the Apex way
-u credentials become req.setHeader('Authorization', 'Basic ' + EncodingUtil.base64Encode(Blob.valueOf('user:pass'))); — encoded at runtime inside your org, not baked into the snippet.
Send, then System.debug
Http http = new Http(); HttpResponse res = http.send(req); with System.debug lines printing the status code and body — runnable as-is.
Technical documentation
How cURL maps to Apex HttpRequest
The generated code follows the canonical Salesforce callout shape: HttpRequest req = new HttpRequest(); followed by req.setEndpoint(...) with your URL, req.setMethod(...) with the verb uppercased, and one req.setHeader(name, value) call per -H flag, in the same order curl sends them. Execution uses the standard Http http = new Http(); HttpResponse res = http.send(req); pair, with System.debug lines printing the status code and response body.
The output is valid anonymous Apex: copy it into the Developer Console (Debug → Open Execute Anonymous Window) and run it as-is, or lift the request-building block into a class method. Bare GET requests simply omit setBody and setHeader when your command carried no headers or data.
Single-quote escaping and Apex string-literal limits
Apex string literals are delimited by single quotes, which is exactly where naive converters break. This tool escapes every single quote as \' and doubles every backslash to \\ across the URL, header values, and body, so pasted JSON with apostrophes, Windows paths, or regex fragments compiles cleanly. Newlines inside raw bodies are emitted as \n escapes, keeping every literal on a single source line.
JSON bodies are re-serialized in minified form onto that single line — no multi-line literals that break mid-string when pasted into the Developer Console, and no pretty-print padding that inflates the payload toward Apex's compiled string-literal length limits. The bytes you send are exactly the bytes curl would send.
Basic auth through EncodingUtil
When your command carries -u user:pass — or credentials embedded in the URL — the converter emits req.setHeader('Authorization', 'Basic ' + EncodingUtil.base64Encode(Blob.valueOf('user:pass')));, the idiomatic Apex pattern. The base64 encoding happens at runtime inside your org, computed by Salesforce with correct UTF-8 semantics instead of being baked into the snippet as an opaque precomputed string.
An explicit Authorization header from your cURL command always wins: bearer tokens and API keys pass through untouched, and the generated Basic header is suppressed so the request never carries two conflicting credentials.
Running the generated callout in Salesforce
Apex callouts can only reach endpoints you have whitelisted: add the host under Setup → Remote Site Settings, or configure a Named Credential and swap the endpoint for callout:My_Credential/path. Wrap http.send(req) in a try/catch for System.CalloutException so DNS failures, timeouts, and unexpected redirects surface the way production code expects.
Keep Salesforce governor limits in mind when adapting the snippet: Apex allows 100 callouts per transaction, req.setTimeout() accepts up to 120,000 milliseconds, and a callout cannot follow uncommitted DML in the same transaction. It is a stricter environment than curl, but the generated request itself transfers unchanged.
Frequently Asked Questions
Is my Salesforce token safe when converting cURL to Apex?
Yes. The transpiler is a static client-side script — your command, including bearer tokens and session IDs, is parsed by your own browser and never uploaded, stored, or logged.
Why does my callout fail with an unauthorized-endpoint error?
Salesforce blocks callouts to hosts that are not whitelisted. Add the endpoint under Setup → Remote Site Settings, or configure a Named Credential and reference it as callout:My_Credential in setEndpoint() — the generated code works unchanged.
How do I run the generated Apex?
Paste it into the Developer Console (Debug → Open Execute Anonymous Window) and execute. To productionize, lift the request-building block into an Apex class method — it transfers unchanged.
How are JSON bodies converted?
The payload is compacted and escaped into an Apex string literal passed to req.setBody(), with Content-Type carried over from your -H flag, so the wire request matches what curl sent.
Does it convert PUT, PATCH, and DELETE requests?
Yes. The verb comes from -X/--request or is inferred (POST when a body flag is present), and setMethod() uppercases it — Apex expects uppercase HTTP method names.
How is basic auth (-u) converted for Apex?
The converter emits an Authorization header built with EncodingUtil.base64Encode(Blob.valueOf('user:pass')), so the base64 encoding runs at runtime inside Salesforce with correct UTF-8 handling — the same pattern the Apex documentation uses.
How does the converter escape quotes for Apex strings?
Apex uses single-quoted strings, so every single quote in your URL, headers, or body is escaped to \' and every backslash is doubled. Newlines become \n escapes so each literal stays on one source line.