https://openapi-proxy.com

openapi-proxy.com documentation

Paste an OpenAPI document, get a live URL. That URL mocks your API before it exists; point it at the real thing and it validates every request and response against the contract, and reports where production has drifted from what you publish.

Three steps, each one optional and each one useful on its own: mock a document, observe real traffic against it, enforce it when you trust what observe showed you.

Start

  • The mock in sixty seconds - paste, fetch from a URL, or start from one of our examples, and get a live mock with a shareable address.
  • Your first proxy - pointing that URL at a real upstream: observe mode, enforce mode, and the one default that matters most.
  • Spec versions - versions are immutable and content-addressed. Publishing is moving a pointer, so rolling back is the same action in the other direction.

Drift

The part the subscription is actually for: what does my API do that my contract does not say?

  • The drift report - one row per shape of disagreement, however many million times it happened. Rates, windows, and what is new since Friday.
  • Coverage - how much of your traffic was actually weighed, and the reason for every response that was not. Read this before you trust a quiet drift report.
  • What changed when it shipped - the contract diff, and which drift stopped, started or carried over across a version boundary.
  • Alerts - a webhook or Slack message when a rate stays over a threshold. Deliberately dull.

Shipping

  • Environments - staging and production as named pointers at versions, so promotion and rollback are the same one-click action.
  • Custom domains - api.yourcompany.com in front of a proxy, certificate included.
  • API keys - keys the gateway enforces because your document's security says so, not because we invented a policy language.
  • The docs portal - a documentation site rendered from the same compiled spec the gateway is enforcing, with your prose folded in.

Automation

  • The API and the CLI - everything the console does, from a terminal or a pipeline. A write action that exists only in a browser is one you cannot perform at 3am, so there are none.

Trust

  • What leaves your network - fingerprints, the one redacted example, the one exception, and exactly what we never see.
  • Self-hosted - the same gateway as a container inside your network, for the security reviews that end with "traffic does not leave".