Start with a workflow, not a list of URLs

An undocumented API is easier to understand when you can see the interface that uses it. Loading a project list, opening a detail view or submitting a search gives each request a purpose. That context helps you distinguish a useful operation from analytics calls and background traffic.

This approach is useful when you inherit a web application, investigate an integration or need to recover documentation for an API already in use. The browser shows the exchanges between client and server; you do not need access to the server’s source code to begin documenting those exchanges.

Capture the workflow with apispy

  1. Install Google Chrome. It is the only additional application required by apispy. If it is missing, get it from the official Chrome download page.
  2. Open the analysis browser from apispy. Navigate to the website and sign in normally. apispy uses a dedicated persistent browser profile.
  3. Perform one recognizable task. For example, open a list and then a detail page. Keep the first exploration focused so you can connect each interaction to its requests.
  4. Select the relevant domain. Inspect its Operations and Overview views. Organize useful domains in folders or favorites, and exclude unrelated hosts from further capture.
  5. Vary the inputs. Try another item, change a filter or navigate to another page of results. Repeated observations help reveal parameterized paths, optional fields and different response shapes.

Example: follow a project from list to detail

Imagine a web interface that lists projects and opens a selected project. The following sequence is illustrative, not a capture from a particular service:

Illustrative browser workflow
1. Open the project list
   GET /projects
   response: { "items": [{ "id": "project_7d8e9f01" }] }

2. Select a project
   GET /projects/project_7d8e9f01

3. Inspect the observations
   Which response fields describe the project?
   Does another project use the same path structure?
   Where is the returned identifier used next?

The useful result is more than two URLs. You learn where an identifier comes from, where it is sent next and which data structures each operation returns. apispy’s Flow view reports observed reuse of distinctive values between responses and later requests. These are evidence of a relationship, not proof that every linked call is a mandatory prerequisite.

Recognize the protocol behind the endpoint

Not every operation has a distinct HTTP path. GraphQL and JSON-RPC can send many named operations through the same endpoint, and a single request can contain several batched operations. apispy separates these calls from their request bodies so they remain individually readable.

Use GraphQL reconstruction to recover observed response types, including when clients send persisted query hashes. For a live feature, inspect WebSocket and server-sent event traffic to understand the messages carried after the connection opens.

Check the gaps before building on your findings

Reverse engineering from traffic is observational. A successful request does not establish the shape of an error, and one response does not reveal every optional field. The Coverage view flags operations seen once, fields that stayed null and responses without a body so you can decide what to exercise next.

apispy cannot recover hidden endpoints, fields the client never requests or the server’s internal implementation. Header names and authentication schemes can be documented, but credential values are not retained in the inferred documentation. Review data handling and example filtering before sharing your findings.

Turn the findings into reusable documentation

Export HTTP operations as OpenAPI 3.1, GraphQL types as SDL and event channels as AsyncAPI 3. The output gives you a structured starting point for reviewing an integration or documenting a legacy application.

The Chrome DevTools Network panel is useful for examining individual network exchanges. apispy adds a persistent workspace, schema inference, coverage analysis and specification exports to that investigation. It captures through the browser’s DevTools Protocol, so no system proxy, root certificate or browser extension is required.

Product behavior described here reflects apispy v0.1. Inferred documentation depends on the traffic you observe.