Explain curl code

What this curl sample shows

-s and -f

-s hides the progress bar, and -f makes an HTTP error count as a failure. Against a page that answers 404, curl -sf printed nothing and exited with code 22, so a script can stop there. Without -f, curl printed the error page, {"error":"not found"}, and exited with 0 as if it had worked.

--json and -H

--json sends its text as the body and adds the JSON headers: the test server saw a POST with Content-Type: application/json, Accept: application/json and the body {"item":"mug","qty":2}. Each -H adds a header, and the server saw Authorization: Bearer followed by the token from $ORDERS_TOKEN.

-L, -o and -w

/old answers with a 301 redirect. Without -L, -w "%{http_code}" printed 301. With -L, curl followed it to /api/orders, saved that reply in orders.json and printed 200.

-X and -i

-X DELETE changes the method, and the server saw DELETE /api/orders/42. -i put the response headers above the body: HTTP/1.0 200 OK, the Content-Type and the Content-Length.

Good to know

• Run with curl 8.21 against a test server on this machine that sends back what it received: no request left the machine.
• -d also sends a body, but as form data: with -d '{"item":"mug"}' the server saw Content-Type: application/x-www-form-urlencoded, not JSON. Adding -H "Content-Type: application/json" changed that, or use --json.
• -s also hides curl's own error message. With -sS, a 404 still printed curl: (22) The requested URL returned error: 404.
• Single quotes stop the shell from filling in a variable: with -H 'Authorization: Bearer $ORDERS_TOKEN', the server got the words $ORDERS_TOKEN instead of the token.

Watch out: Quote any URL with & in it. Unquoted, curl -s http://localhost:8080/api/orders?status=open&limit=5 was split by the shell at the &: curl ran in the background and the server saw only /api/orders?status=open, with limit=5 gone.