api-tools/README.md

API Tools

API Tools is a local-first HTTP and event API workbench. It parses bounded JSON or YAML OpenAPI 3.0–3.2 and AsyncAPI 2.0–3.1 descriptions, navigates path and webhook receiver operations, channels, and messages, resolves $ref values from explicitly supplied local files, inventories security schemes, generates focused schema examples, compares revisions, and checks saved HAR 1.2 traffic against a loaded OpenAPI contract while keeping request and broker execution disabled.

It never executes HTTP, connects or subscribes to a broker, follows a URL, resolves a remote reference, stores a credential, or loads an external asset. Generated curl, Fetch and Python snippets are text for review and may reproduce untrusted description values safely quoted for their target syntax.

Development and release

Requires Node.js 22+ and npm 11+.

npm ci
npm run check
npm run test:browser
npm run release:artifact

The release command writes deterministic release/api-tools-0.2.0.zip and a SHA-256 sidecar. Relative assets are tested at /deep/nested/api/.

v0.1 boundary

• JSON/YAML files up to 4 MiB each, 20 files/16 MiB per selected workspace, depth 64, 100,000 values, 50 YAML aliases, 2,000 operations;
• focused OpenAPI identity/info/paths checks, including 3.2 query and additionalOperations and 3.1/3.2 webhook receiver inventory/comparison, plus AsyncAPI 2.x/3.x channel/operation/message inventories and remote-reference rejection;
• fragment/relative-file JSON Pointer resolution with missing/cycle reports;
• bounded sample generation for common schema composition and scalar formats;
• path/query/request/response examples and inert curl/Fetch/Python output;
• security scheme inventory, conservative operation compatibility report;
• HAR coverage and focused method/path/parameter/status/media-type/JSON-body contract checks without rendering bodies or secrets; raw exchanges retain a summary-only mode.

This is not a complete OpenAPI, AsyncAPI, or JSON Schema validator, code generator, API client, broker client, proxy, or security scanner. See the documented limitations and review generated values before use. Licensed under GPL-3.0-or-later.