Send real requests against the partner endpoints, straight from the browser. Edit the headers and body JSON and hit send — nothing is simulated, and side-effecting requests (transfers, invites) really happen. A refused request comes back with a machine-readable code alongside its message.