Site APIs

Overview

Site APIs is the API capture surface in the Allternit platform. It ingests HTTP traffic — from a browser DevTools HAR export or from a live ACI browser capture — and turns that traffic into a typed, replayable API contract. You can inspect endpoints, edit parameters, replay requests live, generate client code in Python, TypeScript, or cURL, and publish the whole workflow as an agent skill in the Skills Registry. The surface is designed for the “I use this web API every day, let me make it an agent tool” workflow: capture once, validate by replaying, then hand the generated client to an agent.

How to access it

Site APIs runs inside the platform shell:

https://app.allternit.com/shell?view=site-apis

Open programmatically from shell code:

open('site-apis');

You can also launch it from the browser surface (operator-browser) by starting an API capture session while you navigate a site.

Workflow

The surface is organized around a four-step pipeline:

Upload HAR — drop a .har JSON file exported from Chrome/Firefox DevTools, or start a live capture.
Extract contract — Allternit parses the traffic and groups endpoints by domain into a SiteApiContract.
Replay — pick an endpoint, edit path/query params, headers, and body, then send the request live.
Generate client — export a Python, TypeScript, or cURL client, or publish the contract as an agent skill.

Features

HAR ingestion

Upload a DevTools HAR export or receive one from a live browser/ACI capture

Contract extraction

Automatically derive typed endpoints, path/query params, headers, and body templates

Live replay

Edit values and replay requests against the real host to verify behavior

Client generation

Generate Python, TypeScript, or cURL clients from captured endpoints

Skill publishing

Publish a captured contract as a reusable API skill for agents

Domain organization

Contracts are grouped by domain with per-endpoint hit counts and timestamps

Key concepts

Capture session

A capture session represents one recording of HTTP traffic. Sessions have a source (browser, aci, or upload) and a status (capturing, completed, or failed). Sessions are currently local-only; the derived contracts are persisted in localStorage so they survive reloads.

Site API contract

A SiteApiContract groups all endpoints discovered for a single domain. Each contract contains:

Field	Description
`id`	Unique contract identifier
`domain`	Host the endpoints belong to
`derived_at`	ISO timestamp when the contract was created
`endpoints`	Array of extracted `Endpoint` objects

Endpoint

An endpoint is a single HTTP request pattern extracted from traffic:

Field	Description
`method`	HTTP method (`GET`, `POST`, etc.)
`path` / `path_template`	Resolved path, with templated path params in `{name}` form
`query_params`	Query parameters found in the capture
`path_params`	Path parameters inferred from the template
`headers`	Captured request headers
`body_template`	Sample request body, if any
`body_params`	Inferred body fields
`hit_count`	Number of times this pattern was seen in the capture

Replay input

When you replay an endpoint, you supply:

interface ReplayInput {
  path_params: Record<string, string>;
  query_params: Record<string, string>;
  headers: Array<{ name: string; value: string }>;
  body: unknown;
}

The replay engine substitutes path params, appends query params, merges headers, and sends the request directly from the browser.

API skill

Publishing a contract creates an ApiSkill entry that agents can use:

interface ApiSkill {
  id: string;
  name: string;
  description: string;
  domain: string;
  mode: 'API';
  origin: 'api-capture';
  contractId: string;
  endpoints: ApiSkillEndpointRef[];
  status: 'active' | 'inactive';
}

Published skills are stored in localStorage and broadcast via allternit:api-skills-changed so the Skills Registry can pick them up.

Endpoints / commands

Method	Path	Description
`POST`	`/api/har-derived-api/ingest`	Parse a HAR JSON payload and return derived endpoints + stats
`POST`	`/api/har-derived-api/client`	Generate a client for the requested endpoints and language

Client generation example

Request

curl -X POST https://api.allternit.com/api/har-derived-api/client \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "endpoints": ["endpoint-id-1", "endpoint-id-2"],
    "language": "typescript"
  }'

Response

{
  "language": "typescript",
  "code": "async function getUser(userId: string) { ... }",
  "notes": ["Authorization header was templated; pass it at runtime."]
}

Supported client languages

Language	Value	Notes
Python	`python`	`requests`-style client
TypeScript	`typescript`	`fetch`-based client
cURL	`curl`	Shell commands for each endpoint

Limitations

Contracts and published skills are currently stored in browser localStorage. Backend persistence is planned.
Replay sends requests directly from the browser, so CORS and network policies of the target host apply.
Live capture sessions (browser / aci) are visible in the UI but session persistence is not yet backed by the server.

Get Started

Core Concepts

Gizzi Code CLI

Tools & ACI

Security & Enterprise

Admin API

BYOC Runtime

Surfaces

CI CD

Guides

Cookbooks

Release Notes

Overview

How to access it

Workflow

Features

HAR ingestion

Contract extraction

Live replay

Client generation

Skill publishing

Domain organization

Key concepts

Capture session

Site API contract

Endpoint

Replay input

API skill

Endpoints / commands

Client generation example

Request

Response

Supported client languages

Limitations

​Overview

​How to access it

​Workflow

​Features

HAR ingestion

Contract extraction

Live replay

Client generation

Skill publishing

Domain organization

​Key concepts

​Capture session

​Site API contract

​Endpoint

​Replay input

​API skill

​Endpoints / commands

​Client generation example

​Request

​Response

​Supported client languages

​Limitations

​Related links

Overview

How to access it

Workflow

Features

Key concepts

Capture session

Site API contract

Endpoint

Replay input

API skill

Endpoints / commands

Client generation example

Request

Response

Supported client languages

Limitations

Related links