Push code. APIOS reads every endpoint, flags breaking changes in caller terms, and holds them for human review. The reference, OpenAPI spec, and mock regenerate from the same approval — nothing drifts.
Nothing publishes without review Every approval kept, permanently Keyboard-first Self-hostable
Docs are a second copy of the truth
The spec is written by hand. The code moves on. Six weeks later the mock returns fields that no longer exist.
Docs are a projection of the truth
No second copy to maintain. The reference, spec, and mock are all derived from your code — and only update after a human approves.
Fully automatic until the step that needs judgment — that one stays yours.
Express, Fastify, Hono, NestJS, Next.js, FastAPI, Flask, Django, Gin, Echo, Fiber, Spring, Rails, Laravel, ASP.NET — route handlers detected automatically, in whichever language they are written. Zero annotations.
Endpoints, params, body fields, status codes, and auth — pulled straight from source.
Auth added to a public route is breaking, even if it's one line. Changes are judged by consumer impact.
One approval regenerates the reference, OpenAPI 3.1 doc, and mock server in a single pass.
A route changes. APIOS reads the push, not a spec you'd have to update by hand.
Generated from the same approved endpoints in one pass. “Mock out of sync with docs” stops being a thing.
Grouped, searchable, with runnable cURL per endpoint. Generated from reviewer-approved code.
JSON or YAML with real operation IDs. Feed it to any generator you already use.
Simulates auth and pagination. Force failures so the frontend can build error states before the backend ships.
Organized by resource, documented to the source file and line, with auth and environment pre-wired.
A dashboard gets checked after the outage. A required CI check blocks the merge until someone reviews the consumer impact.
# fails the build when the API changed and nobody said so
curl -X POST $APIOS_URL/api/check \
-H "Authorization: Bearer $APIOS_API_KEY" \
-d '{"repository":"acme/orders","ref":"$GITHUB_SHA"}'
# → { "ok": false, "counts": { "breaking": 1 },
"findings": [{ "kind": "field.removed",
"method": "GET", "path": "/orders/:id" }],
"reviewUrl": "…/builder?rail=review" }Try it here — real requests, no account needed. Sign in once for the full workspace. Your data stays in the browser.
This is a real request.
Press Send and it goes out through the same proxy the product uses, real latency, real headers, no CORS.
Composing the request was never the hard part.
Every failure gets a root cause, a fix, and the checks to run — grounded in the actual request.
Describe the endpoint in plain English. Get method, URL, headers, payload, and docs.
Assertions derived from the response you received. Every path is guaranteed to exist.
DNS, TCP, TLS, TTFB, and download — measured at the socket, explained in a sentence.
Bind a token from a login response and every subsequent request uses it. No scripts.
Drop a cURL from docs, a bug report, or DevTools. The entire request populates instantly.
Runner, mock server, monitors, four protocols, and import — one workspace instead of four tools.
Run a folder top to bottom, carrying values forward. Assertions per step, stop on failure, save the report.
WebSocket, SSE, and gRPC-Web — same tabs, environments, and history as HTTP.
Mark a variable secret and it stays masked. Share the environment — keys travel, values don't.
OpenAPI 3.x, Postman v2.1, and cURL in. Postman out. Nothing is trapped.
Turn any request into a code snippet with variables resolved. What you paste is what you sent.
The response viewer remembers the last run and highlights what changed. No more guessing.
Schedule any request, assert on the response. Hear it from us, not your customers.
Full request history, searchable, plus a cookie jar that behaves like a browser's.
Every action, two keystrokes away. One palette for requests, environments, tabs, and commands.
Requests
Actions
They all diff a hand-maintained spec. That’s the artifact that drifts.
Free became one seat in March 2026. APIOS adds governance, built on code, not a hand-written spec.
Read the comparison vs ApidogRight shape, wrong direction. A design-first spec is only as current as whoever remembers to update it.
Read the comparison vs OpticArchived January 2026, no migration path. If you're looking for where to go next, start here.
Read the comparisonEvery guarantee is enforced server-side, not behind a greyed-out button.
Reviewers approve. A separate permission publishes. Enforced server-side, not behind a greyed-out button.
Every publish, role change, and connection logged with who did it. Post-incident, you'll have the answer.
Role-scoped API keys for CI — no more session cookies pasted into secrets.
Publish publicly or share a single link. Partners read the real docs without an account.
Consumers tracked per endpoint. Breaking changes measured by who calls it, not diff size.
Real-time presence and updates. Two people in the review queue see the same queue.
Scale is metered — seats, repos, audit retention. Review and breaking-change detection are always free.
A real team, and the whole pipeline.
$0forever
Start freePriced for the org, not per head.
$299per month, per workspace
Start with your teamFor teams with a security review.
Customannual
Talk to usTeam pricing is per workspace, not per seat. Add reviewers freely. Self-hosting available on every tier, including free.
Connect a repo and see your first proposal. Or send a request in ten seconds. Free, forever.