How to Analyze HAR Files for API Debugging

Open the browser Network panel before reproducing the issue. Clear unrelated requests, preserve the log only if navigation or redirects matter, and repeat the failing action once. Note the browser version, page URL and exact action separately; a capture without reproduction steps is difficult to interpret.

Export the capture as HAR and inspect a local copy. Captures can contain cookies, authorization values, query strings and response content. A sanitized browser export reduces some sensitive fields but does not automatically make every URL or body safe to share.

Two requests can overlap. Adding their durations does not measure page load time. The analyzer reports a sum and an elapsed capture window separately, calculated from available start timestamps and durations. Missing timestamps make the elapsed figure unavailable.

In this fixture, the requests total 1,820 ms, but the final response ends 1,350 ms after the first request begins. Neither number measures when the page became interactive. Use the browser performance timeline for that question.

A recorded 4xx or 5xx response is an HTTP failure. Status 0 is a separate category: the export did not record a normal HTTP response. Inspect browser console messages, cancellation and connection behavior rather than automatically calling it a server 500 or a CORS error.

Sort the relevant API calls by duration, then inspect repeated method-and-URL pairs. Repetition may be intentional polling or retries. Compare request bodies and the client's retry configuration before deciding it is an accidental duplicate.

Look for an existing request identifier in the response and search gateway/application logs for the same identifier in a narrow time range. Keep method, path, status and timezone alongside it. A browser capture alone cannot identify a database lock or explain an application's internal exception.

If a gateway saw a request but the application did not, inspect routing and authentication at that hop. If the application produced the 500, use its exception and deployment context. Avoid changing client timeouts before establishing where the time was spent.

The tool's summary omits headers and response bodies but includes full request URLs. Query parameters can still contain personal values or access tokens. Review the summary before using Copy or Export; do not assume a text summary is automatically anonymized.

Record the failing request, your observation and one testable next step. Repeat the same action after a fix and compare the same fields. Retain the original capture privately if timing or redirect evidence may be needed later.