# API Tools

API Tools is a local-first HTTP and event API workbench. It parses bounded JSON
or YAML OpenAPI 3.0–3.2 and AsyncAPI 2.0–3.1 descriptions, navigates path and
webhook receiver operations, channels, and messages, resolves `$ref` values
from explicitly supplied local files, inventories security schemes, generates
focused schema examples, compares revisions, and checks saved HAR 1.2 traffic
against a loaded OpenAPI contract while keeping request and broker execution
disabled.

It never executes HTTP, connects or subscribes to a broker, follows a URL,
resolves a remote reference, stores a credential, or loads an external asset.
Generated curl, Fetch and Python snippets are text for review and may reproduce
untrusted description values safely quoted for their target syntax.

## Development and release

Requires Node.js 22+ and npm 11+.

```sh
npm ci
npm run check
npm run test:browser
npm run release:artifact
```

The release command writes deterministic `release/api-tools-0.2.0.zip` and a
SHA-256 sidecar. Relative assets are tested at `/deep/nested/api/`.

## v0.1 boundary

- JSON/YAML files up to 4 MiB each, 20 files/16 MiB per selected workspace,
  depth 64, 100,000 values, 50 YAML aliases, 2,000 operations;
- focused OpenAPI identity/info/paths checks, including 3.2 `query` and
  `additionalOperations` and 3.1/3.2 webhook receiver inventory/comparison,
  plus AsyncAPI 2.x/3.x channel/operation/message inventories and
  remote-reference rejection;
- fragment/relative-file JSON Pointer resolution with missing/cycle reports;
- bounded sample generation for common schema composition and scalar formats;
- path/query/request/response examples and inert curl/Fetch/Python output;
- security scheme inventory, conservative operation compatibility report;
- HAR coverage and focused method/path/parameter/status/media-type/JSON-body
  contract checks without rendering bodies or secrets; raw exchanges retain a
  summary-only mode.

This is not a complete OpenAPI, AsyncAPI, or JSON Schema validator, code
generator, API client, broker client, proxy, or security scanner. See the
documented limitations and review generated values before use. Licensed under
GPL-3.0-or-later.