Test your APIs
know them first
An API client that reads your source and tells you what the API actually is — every endpoint, what it expects, and what it touches.
- macOS & Windows
- Free, no account needed
- Your code never leaves your machine
Every endpoint read straight out of your source — with its schema, its responses and what guards it.
It reads the code, so you do not have to
Open a service you have never seen and know its whole API in seconds — what it exposes, what it expects, what it touches, and where it is unsafe.
Every route, from the source
Point at a repository and get the full surface: method, path, the middleware chain that guards it, and the handler it lands in. No spec file, no annotations, nothing to install into your project.
The queries behind each endpoint
Which tables a route reads and which it writes, with the query reconstructed as written — Prisma, knex, Mongoose, Sequelize, TypeORM, Supabase or raw SQL. It follows the call from your controller into the service.
The problems you have not found yet
Destructive routes with no auth in their chain. Body fields reaching a handler with no schema. Routes shadowed by an earlier pattern that will never run. Files defining routes nothing mounts.
Everything you expect from an API client
The requests it finds are ready to send, already filled in from the schema — a number where the code wants a number, a real value where it wants an enum.
Send anything
Full request builder — params, headers, body, auth, cookies, multipart. Variables resolve from environments, coloured by whether they actually have a value.
Chain requests into flows
Log in, take the token out of the response, carry it into the next call. Connect requests on a canvas and say what each one passes forward.
Keep what came back
Save any response against the endpoint it came from, so the shape you saw last week is still there when the API changes.
Generate the types
Turn any response into TypeScript, Zod, JSON Schema, Dart, Python or Go without leaving the response pane.
What it can read
Every one of these has its endpoints read out of the source. The first two go further — schemas, database access and the security audit.
Point it at something and see
A public GitHub repository scans in the browser with no account. Your own machine needs the app.