API URL Kit
Part of: Browser-Based Developer Tools: Why Client-Side Beats Uploading

How to Extract All URLs from an API Response

4 min read Updated 17 August 2026

A nested JSON response on the left resolving into a flat deduplicated list of URLs on the right

Whether you are auditing assets, building a migration script, or just grabbing every image link from a response, manually hunting for URLs in a nested JSON blob is tedious. Here is a faster way.

The manual approach (and why it is painful)

The usual options are writing a one-off grep, a regex in your editor, or a throwaway script. They work, but every time you have to remember the pattern, handle escaped slashes, and dedupe the results yourself.

Getting the regex right is its own detour — if that is where you are stuck, the Regex Tester will at least let you iterate on the pattern against real sample text.

The one-click approach

  1. Copy your full API response — REST, GraphQL, Postman export or Insomnia response.
  2. Open the API URL Extractor and paste it into the JSON tab.
  3. Click Extract URLs. Every http(s) URL is pulled out, with escaped slashes already cleaned.
  4. Click Remove Duplicates for a unique list.

Filter to exactly what you need

Once extracted, use the filter bar to narrow the results:

  • By type — show only Images, Videos or other links.
  • By domain or substring — type cdn to keep only CDN URLs.
  • Valid only — hide anything that is not a well-formed URL.

The media preview grid renders images and videos inline, so you can eyeball assets without opening each one in a new tab.

Export the list

When the result looks right, Copy it, or download as TXT or CSV — ready for an SEO crawl, a link checker, or a migration script.

Working with a plain URL list?

Switch to the URL List tab to paste one URL per line instead of full JSON. The same dedupe, filter and export tools apply.

Comparing two exports to see what changed between environments is a job for the Diff Checker.

The edge cases that break naive extraction

A regex like https?://\S+ gets you most of the way and then quietly loses data. The cases that actually bite:

  • Escaped slashes. https:\/\/cdn.example.com will not match a pattern expecting //, so those URLs vanish from the results entirely rather than arriving malformed — a silent loss, which is the worst kind.
  • Trailing punctuation. A URL at the end of a sentence in a description field picks up the full stop. \S+ happily includes it, and the resulting link 404s.
  • Query strings with commas. Split a line on commas to tidy it up and any URL carrying ?ids=1,2,3 is torn in half.
  • Protocol-relative URLs. //cdn.example.com/img.png is a valid reference that a pattern anchored on http never sees.
  • Duplicates that differ by a trailing slash. example.com/a and example.com/a/ are two strings and one resource. A naive dedupe keeps both.

The extractor handles each of these, which is most of the reason it exists: the regex is not the hard part, the exceptions are.

Auditing a whole environment

The workflow scales past a single response. To inventory every asset a service references, collect the responses from the endpoints you care about, paste them in one after another, and export once at the end — the deduplication runs across everything you have pasted in the session, not per paste.

That gives you a single list suitable for feeding to a link checker, diffing against your CDN’s file listing to find orphaned assets, or comparing against last month’s export to see what changed.

A note on pasting production responses

API responses carry internal hostnames, object IDs and sometimes customer data. This extractor runs entirely in your browser and transmits nothing — which is worth verifying rather than trusting, and browser-based developer tools explains how to check that for any tool in about ten seconds.

← All articles