01
Open the analysis browser
Install Google Chrome if you don’t already have it, then launch the analysis browser from apispy. Sign in and use the website in a dedicated browser profile.
API DISCOVERY, ON YOUR DESKTOP
Browse the app.
Understand the API.
HTTP. GraphQL. Real-time.
One connected workspace.
One connected workspace.
Turn browser traffic into API documentation. Discover operations, reconstruct schemas, and export OpenAPI, GraphQL and AsyncAPI as you browse.
One prerequisite: Google Chrome installed on your machine. See requirements
No system proxy. No root certificate. Captured on your machine.
A real capture. A clearer picture.
apispy v0.1 · Captured Twitch traffic
Local captureOpenAPI · GraphQL · AsyncAPIv0.1.0
OpenAPI 3.1HTTP requests → structured documentation
GraphQL SDLObserved responses → reconstructed types
AsyncAPI 3.0Live streams → documented channels
01 / THE WORKFLOW
You browse.
The documentation follows.
Start with the application you need to understand. Let the actual requests tell you how its API works.
02
Exercise the real workflows
Search, navigate, submit a form. apispy observes requests and streams, and organizes what it finds by domain.
03
Inspect, then export
Explore operations and inferred schemas. Check coverage, then export documentation to use in your own tools.
02 / FROM TRAFFIC TO UNDERSTANDING
The details behind
every interaction.
An API is more than its URLs. See the operations, data shapes and dependencies that make it work.
/01One endpoint.
One endpoint.
Many operations.
GraphQL and JSON-RPC often put everything behind a single URL. apispy separates calls by operation and unpacks batched requests, so each one gets its own documentation.
Explore GraphQL reconstructionONE URL · DISTINCT OPERATIONS
POST
/graphql× 3GetCurrentUserquerySearchProjectsqueryUpdateProjectmutation/02Useful schemas.
Useful schemas.
Familiar formats.
Take your findings beyond the network panel. Export HTTP operations as OpenAPI 3.1, GraphQL types as SDL, and WebSocket or server-sent event channels as AsyncAPI 3.
Explore OpenAPI generationYOUR CAPTURE · STANDARD FORMATS
openapi.jsonOpenAPI 3.1schema.graphqlGraphQL SDLasyncapi.jsonAsyncAPI 3.0/03Know what you saw.
Know what you saw.
And what to explore next.
Coverage surfaces operations seen once, fields that stayed null and responses without a body. Call-order links show when a value from one response appears in a later request.
See how the workflow worksOBSERVATIONS · NEXT STEPS
Seen onceExercise the operation again
Always nullFind a case with a value
No error observedExplore an error response
03 / YOUR WORKSPACE, YOUR MACHINE
Keep the capture
close to the code.
The capture and schema inference run locally. Your session is saved on your machine and resumes when you reopen the app.
- No system-wide traffic interception
- No root certificate to install
- No automatic capture upload
YOUR COMPUTER
apispyCapture & inference
Analysis browser•••
apispyCapture & inferenceYour documentationLOCAL
FIELD NOTES
Get to know the API
behind the interface.
Practical guides to what you can discover, how it works, and what the output tells you.
USE CASE / API REVERSE ENGINEERING
No API docs?
Start with the application.
Discover the requests behind a real workflow, follow the data between calls and build documentation from what you observe.
Read the reverse engineering guideHTTP / REST
Generate OpenAPI from browser traffic
From observed requests to an OpenAPI 3.1 document you can inspect and export.
Read the guideGRAPHQL
Reconstruct a GraphQL schema
Discover types and operations, including traffic that uses persisted queries.
Read the guideWEBSOCKET / SSE
Document the real-time conversation
Turn observed stream messages into AsyncAPI channels and message schemas.
Read the guideTHE ESSENTIALS
A few things
worth knowing.
What is apispy?
apispy is a desktop application for discovering and documenting APIs from browser traffic. It infers OpenAPI 3.1 documents, reconstructs GraphQL schemas, and describes WebSocket and server-sent event channels with AsyncAPI 3.
What do I need to install?
Google Chrome is the only additional application you need to install to use apispy. apispy launches your installed Chrome in a dedicated analysis profile. No browser extension, system proxy or root certificate is required.
Does apispy need a proxy or a certificate?
No. apispy observes traffic inside a dedicated Chrome analysis browser through the Chrome DevTools Protocol. Chrome handles HTTPS, so there is no system proxy to configure and no root certificate to install. Google Chrome must be installed.
Can I use apispy to reverse engineer an API?
Yes. Use a website in the analysis browser to discover the API operations behind its interface, infer request and response schemas, and identify observed links between calls. apispy exports what it learns as OpenAPI, GraphQL SDL or AsyncAPI. It documents the behavior you exercise, not unobserved endpoints or server-side implementation.
Will it discover the entire API?
It documents what you exercise in the analysis browser. Unvisited workflows, unseen fields and unobserved error responses cannot be inferred. Use the Coverage view to identify where more observations would help.
Does my captured data leave my computer?
Capture and inference run on your machine, and saved sessions stay there. apispy does not automatically upload captures. Exports may contain example values, so review them before sharing.
Which platforms are planned?
The desktop release is planned for Windows, macOS and Linux, each in x64 and ARM64. On macOS, these correspond to Intel and Apple silicon. Linux packages are planned in DEB, RPM and AppImage formats for both architectures. The download page shows the availability of each build.
How will licensing work?
apispy is a proprietary application. A paid license is planned; pricing and license terms have not yet been announced.
LESS GUESSWORK. MORE UNDERSTANDING.
Your next API discovery
starts with a browser.
Capture the traffic. Understand the schema. Keep the results.
Get apispyWindows, macOS & Linux · x64 & ARM64