OpenAPI Contract Check

Compare your API responses with the contract you supply.

Check explicitly selected API endpoints against an OpenAPI JSON or YAML document, with response evidence and optional baseline comparison.

Declared response statuses, media types, headers, and supported schemas
Required parameters and authentication declarations
Selected GET or HEAD endpoints on one verified origin
Potential breaking changes against an optional supplied baseline

$19one-time full run

Up to 25 selected read-only endpoints per runMonthly option: $39/month, four runs

Start here

Start a check

1 selected read-only endpoint. No card required.

Free allowance: 3 checks per 24-hour window across all tools. The window resets 24 hours after its first use. Shared-network and service limits also apply. Paid purchases do not use this free allowance.

Verified API base URL

Use a public target. Do not include passwords, tokens, personal information, or private network addresses.

Sign in to run this check. Every verification check requires a signed-in account and verified hostname, including the free preview.

Contract and selected endpoints

Endpoint URLs to requestOne explicit URL per line on the API origin. Select one for the free preview or up to 25 for a paid run. The base URL is not added automatically. Ordinary query parameters are allowed within 512 characters; credentials and personal data are not.

Specification source

OpenAPI JSON or YAML document

Compare a baseline contract (optional)

Baseline OpenAPI JSON or YAML

The combined configuration is limited to 50,000 bytes. Use a hosted specification for larger documents. External references and state-changing requests are not executed. Keep secrets and private data out of documents.

API method and optional saved credentials

Read-only HTTP methodSaved credential for this origin

Only a saved credential ID is sent with a scan. Credential values are never included in reports. Manage encrypted API credentials.

I own this target or have permission to scan it, and I agree to the terms of use.

Buy a full check

Up to 25 selected read-only endpoints per run. A free preview is not required.

Preparing a purchase uses no free checks. Scanning starts only after payment is verified. You review the total in Stripe before paying.

One-time purchases cover one paid run and do not renew. Monthly plans renew automatically and include four paid runs per billing period for one verified target. Unused runs do not roll over. Cancel through the billing portal before your next renewal; access continues until the current paid period ends. Paid checks may wait for available service capacity. Prices in USD. You’ll see the total before payment. Terms of use · Privacy policy · Data retention and support.

Reports are private to your account and expire after 30 days.

Choose the contract and the requests

The free preview checks one explicit endpoint. Paid runs check up to 25 selected endpoints using GET or HEAD. The API base establishes the verified origin; it is never added to the request list automatically.

Supply an OpenAPI document as JSON or YAML, or use an HTTPS specification URL on the same origin. Add an optional baseline to review potential breaking changes. Response values and credential headers are excluded from evidence.

State-changing operations are listed without execution. Unsupported features and incomplete requests are reported without a passing claim.

Understand the scope

A report with clear boundaries.

Each report lists the checks performed, the resources reached, and any checks skipped. Findings include observed or heuristic confidence so you can judge the evidence.

Only explicitly selected GET or HEAD endpoints are requested. State-changing operations are listed without execution.
Unsupported schema features, missing credentials, and incomplete responses remain visible as skipped or inconclusive checks.
A passing result is limited to the recorded requests and does not certify API correctness, security, or compatibility.
Use JSON or YAML inline within the request allowance, or an HTTPS specification URL on the same origin. External references are not fetched.
Sign-in and DNS verification of the exact target hostname are required for every run.

Account and target verification are required for every run. Payment and report access are confirmed by the server.

Before you start

What does the free preview include?

1 selected read-only endpoint. The preview shows up to five findings with the scope and limitations of the scan. Zero findings means no issues were detected by those checks, not a guarantee that none exist.

What does a paid run include?

Up to 25 selected read-only endpoints per run. A confirmed purchase unlocks the paid allowance and full available findings, plus HTML and PDF exports. Reports remain private to the owning session or account.

Can I check a private target?

Use a public HTTPS endpoint on your verified domain. You may select an encrypted, saved read-only API credential from your account. Internal network targets remain blocked.