Every push is read for what it does to callers and classified as breaking or not — in caller terms, not diff lines — then held for a human to approve before anyone sees it. That decision is logged permanently, so “who approved this and when” is always answerable. The reference, the OpenAPI spec and a live mock regenerate from the same approved change, which is what makes nothing hand-maintained and nothing able to drift.
Nothing publishes without review Every approval kept, permanently Keyboard-first Self-hostable
Docs are a second copy of the truth
Someone writes the spec by hand. The code moves. The spec doesn’t. Six weeks later nobody trusts the collection, the mock returns fields that no longer exist, and the SDK is generated from a document that stopped being true in March.
Docs are a projection of the truth
There is no second copy to fall behind. The reference, the spec and the mock are all derived from the endpoints in your repository — and a change only reaches them after a person has read what it does to callers and approved it.
The pipeline is automatic right up to the point where judgment is required. That step is yours, permanently.
Express, Fastify, Hono, NestJS and Next route handlers are detected automatically. Nothing to annotate, no decorators to add.
Endpoints, path and query params, body fields, status codes, and which middleware guards the route — pulled straight from the source.
Auth added to an open route is breaking, even though it's one line. The diff is judged by what it does to consumers, not by lines changed.
One approval regenerates the reference, the OpenAPI 3.1 document and the mock server together — from the same endpoints.
The extractor reads route registrations rather than compiling your project — fast enough to run on a webhook, and fallible enough that a person should look. Reviewers approve; a separate permission ships. That split is enforced on the server, not by hiding a button.
A route changes. APIOS reads the push, not a spec you'd have to update by hand.
They’re generated from the same approved endpoints in the same pass, so “the mock is out of date with the docs” stops being a category of bug that exists.
Grouped, searchable, with runnable cURL per endpoint. Public-facing, generated from what a reviewer approved.
JSON or YAML, correctly templated paths, real operation ids. Feed it to any generator you already use.
Honours pagination, simulates auth, and can be forced to fail or stall so the frontend can build error states before the backend exists.
Foldered by resource, named the way you'd name them, documented down to the file and line each endpoint came from — with auth and an environment already wired up.
Try it right here, no account needed — this playground is a real request through the production proxy, not a recording. Sign in once and the full workspace is yours, data staying local to your browser either way.
This is a real request.
Press Send and it goes out through the same proxy the product uses — real latency, real headers, no CORS.
Composing a request was never the hard part. Understanding the answer is.
A red status code is a starting point, not an answer. Every failure gets a root cause, a fix, and the checks worth running — grounded in the actual request, headers and payload.
Describe the endpoint. Get the method, URL, headers, an example payload and docs — matched to the conventions already in your collection.
Assertions are derived from the response you actually received, so every path they reference is guaranteed to exist. No spec-shaped guesses.
DNS, TCP, TLS, TTFB and download measured at the socket — then told back to you in a sentence. Slow because of the network, or because of them?
Bind a token out of a login response and every request after it uses the value. A rule you can read and review, not a JavaScript snippet buried in a tab.
From the docs, from a bug report, from your browser's network tab. Drop it in the URL bar and the whole request populates — method, headers, body, auth.
Every action is two keystrokes away. Search requests, switch environments, fire a send, jump between tabs — all from one palette that ranks commands and entities together.
Requests
Actions
Postman, Apidog, oasdiff, Redocly — every one of them takes a specification somebody maintains by hand as its input. That’s the artifact that drifts. These pages say where that matters, and where it doesn’t.
Free became one seat in March 2026. Spec Hub added governance — built on the spec, not the code.
Read the comparison vs ApidogThe right shape, built from the wrong end. A design is only as current as whoever remembers to update it.
Read the comparison vs OpticArchived January 2026, no migration path. If you're looking for where to go next, start here.
Read the comparisonWhat’s metered is scale — seats, repositories, how long the audit log is kept. Never review, never breaking-change detection. Charging for the safety features would sabotage the one habit this product needs a team to form.
A real team, and the whole pipeline.
$0forever
Start freePriced for the org, not per head.
$299per month, per workspace
Start with your teamFor teams with a security review.
Customannual
Talk to usTeam is one price for the workspace, however many people are in it — a team that adds three reviewers is using this correctly, and charging for that would teach you not to. Self-hosting is on every tier, including free: the server runs against your own Postgres.
Connect a repository and watch the first proposal arrive. Or sign in and send a request in ten seconds — free, forever.