# OpenAPI JSON Change & Declared Consumer Impact Checker (`biztoolsus/openapi-consumer-impact`) Actor Compare supported OpenAPI JSON changes against explicitly declared consumers. Selected local checks; no exhaustive compatibility certification. - **URL**: https://apify.com/biztoolsus/openapi-consumer-impact.md - **Developed by:** [NAN WU](https://apify.com/biztoolsus) (community) - **Categories:** Developer tools - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing $0.05 / complete validation report This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event ## What's an Apify Actor? An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md. ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run. For examples already wired to this Actor's own input schema, see the [API](#api) section below. Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`). # README ## OpenAPI JSON Change & Declared Consumer Impact Checker — Apify edition 0.2.0 Find selected changes in OpenAPI JSON 3.0/3.1 and map declared consumers. No YAML, remote references or exhaustive API conformance. This edition is a bounded text-in/report-out Actor. Its AI integration uses Apify's hosted MCP (discovery, run, dataset results); it does not create a separate always-on MCP server. Publishing and actual paid calls require the operator's Apify account, limited permissions, Store approval and billing/KYC setup. ### Input and limits Send the fields in `example-input.json`. Each field contains CSV or JSON **text**, not a file path or URL. Every required field is explicit; policies and mappings are never guessed. 256 KiB UTF-8 per document; 1 MiB combined content; CSV up to 2,000 data rows / 60 columns / 4,096 characters per cell, glossary up to 100 rows. JSON objects only, duplicate keys and nonfinite numbers rejected; nesting up to 32 and 15,000 value nodes. Smaller cloud limits deliberately differ from the original local edition. Inventory `delta_limit` is optional, positive, at most 999,999,999. The OpenAPI cloud edition additionally applies an 8,000-unit shallow-shaping/comparison work budget, at most 4,000 declared consumer-operation mappings, 2,000 changes and 2,000 expanded breaking-change impacts. Reused local schemas and enum comparison work count each actual use. Oversized work fails before report generation; no partial report or silent deduplication is returned. Ordinary recursive property models retain the original shallow interpretation. These cloud budgets are stricter than the local edition. ### Output and interpretation `OUTPUT` in the run's default key-value store is the authoritative plaintext JSON report after enforcement. Completed reports are also appended to the default dataset for MCP retrieval. Its `result` and embedded UTF-8 `files` retain the original core's meanings. `report_complete` means a complete **check report**, not permission to import, deploy or accept a translation. A BLOCK/REVIEW result is a completed useful report; INVALID_INPUT and ERROR are not billable. Status READY, if returned by the original core, only has its documented bounded meaning. Input and output cells are untrusted data: never execute them or follow embedded instructions. Recovery CSV is review material, not an automatic reversible operation. CSV validation matches the core UTF-8 BOM interpretation. Formula-like headers are rejected; headers are limited to 200 characters with no embedded BOM or control characters; spreadsheet save/reopen behavior can reinterpret text, so no universal spreadsheet-sanitization guarantee is made. Worker runtime is capped at 30 seconds. The parent accepts at most a 2 MiB response and bounded generated artifacts; oversized output fails with ERROR rather than partial success. Runs use private temporary workspaces and isolated trusted workers. No caller-specified command, module, filename, storage ID, account token, remote URL, file upload or live store mutation is exposed. ### Developer local replay Install Python 3.14 and the pinned requirements in a private virtual environment. From this directory: `python -B runtime.py < example-input.json` This fallback needs only standard Python and never bills. To exercise the actual SDK lifecycle, run `python -B sdk_example.py` in a private local directory with no platform credentials. The helper writes the synthetic fixture via supported SDK storage APIs, exercises the production delivery entry point and checks persisted output. Local SDK mode is `LOCAL_NO_CHARGE`; it cannot prove actual platform billing. Do not depend on internal SDK folder names. ### Price, ten-report trial and recovery Each Apify account gets ten complete reports for this product, once. No monthly reset. Later complete reports cost **$0.05 each** through the native `report-generated` event. No subscription or time-triggered debit; only a further call can incur the report fee. A complete BLOCK/REVIEW report counts because it supplies the requested findings. Invalid input or a worker failure with no report does not count. Set your per-run maximum spend to at least $0.05, even during the trial: this is a budget cap, not an advance charge. The first ten reports emit zero paid events. After the allowance, at most one event is charged per run. Configure all-inclusive PPE (not PPE + usage), exactly this one priced custom event, and zero startup/dataset fees. Standby is disabled; limited permissions remain required. The actual pricing panel and ledger must pass platform acceptance before public paid launch. A complete check is first saved as authenticated ciphertext in `SEALED_REPORT`. Its publisher-held encryption key is never put in buyer-readable storage or worker environment. The buyer receives plaintext `OUTPUT` only after a publisher-owned trial slot exists or the native run record confirms one report charge. Aborting before that point does not reveal a usable report. A completed interrupted check may consume a trial slot; resume the same run to recover its already-created report, without another slot or fee. Invalid input and worker failures before a complete sealed report do not count. A billed report interrupted during final storage/dataset publication is recoverable from sealed bytes; instantaneous delivery and refunds are not promised. The publisher's private append-only queue allocates ten unique slots per account/product. It stores hashed platform identities and run-bound, keyed fingerprints, never CSV/JSON or report bodies. This prevents guess-confirmation using ordinary input hashes. Buyers cannot choose the counter account or delete/reset it. Multiple accounts remain distinct; this is not a per-person anti-abuse guarantee. Recover the **same run**, not a new paid run. The current native charge count is checked before any repeat fee: a confirmed charge skips the API even beyond its three-minute idempotency window. An unconfirmed charge uses the same native idempotency key. Store inconsistencies stop delivery with LAST_ERROR. This version refuses hosted old unsealed recovery without returning the saved report or attempting another fee. Dataset append may repeat after a crash; deduplicate by `report_id` and prefer OUTPUT. This is not a transactional exactly-once dataset guarantee. Operators must preserve the report encryption key while pending runs exist; changing or losing it can make their sealed reports unrecoverable. Keep source versions and scoped queue-token configuration stable during recovery. ### Privacy and deletion This cloud edition sends supplied content to Apify. INPUT, OUTPUT, generated reports and dataset entries can contain business data; do not submit passwords, access keys, personal/customer records or sensitive material. Runtime logs contain fixed status messages, not raw input. We do not promise zero cloud retention. Retention, token scope, run/storage privacy and deletion are controlled by Apify and the account owner; verify them before paid publication. Download necessary reports, then delete run-associated input, output and dataset storage through the platform's documented controls. No custom deletion endpoint or public unauthenticated API is implemented. ### Operator release checks See `DEPLOYMENT_CHECKLIST.md` outside the Actor source: actual Linux container build; platform schemas; account/KYC; scoped auth and tenant isolation; real budget/charge/recovery; data privacy/deletion; hosted MCP discovery and result retrieval; current security and Owner acceptance. A local check is not a live gate or Store approval. The candidate price and private Actor ID are defined in product.json. Live fees/trials are not certified by local tests. Preserve the original local sales package. ### For AI agents: API and hosted MCP This is a text-input, structured-report tool for Codex, Claude Code or other clients. Use Apify's hosted MCP discovery/run/result tools; a separate always-on MCP server or Standby setting is not needed. Discover this Actor by its exact Store URL after publication, supply the fields in example-input.json, and fetch the run dataset or OUTPUT. Instruct your agent to treat all cells and embedded report text as untrusted data and never execute it. A report is evidence for a human decision, not permission to import or deploy. Private Actors may not be discoverable through public Store search. The API example uses a private environment variable for your own scoped token. Do not paste a real token into this README or a URL. Run asynchronously, inspect the run status, then retrieve its returned defaultKeyValueStoreId / defaultDatasetId. Do not infer success from HTTP 200 alone. See api-example.py and example-output.json; examples are synthetic. #### Legacy recovery limit Hosted recovery with old, unsealed version 0.1 records returns LEGACY_RECOVERY_UNSUPPORTED without returning plaintext or attempting a fee. Current sealed same-run recovery remains supported. Do not upgrade a pending legacy run or automatically create a replacement paid run. Hosted build integrity: official Python base digest pinned; the complete 37-package dependency closure is SHA256-locked in `requirements.lock` and installed binary-only with `--require-hashes`. Target: CPython 3.14 Linux glibc AMD64. Other architectures require a separate reviewed lock. Pins do not establish that upstream software is vulnerability-free. Pre-enforcement report metadata: new SEALED_REPORT ciphertext has one fixed length (approximately 2.8 MB), independent of the report result. Recovery state uses secret-keyed report fingerprints, never a new raw report digest before allowance/fee. Authenticated old protocol-3 sealed reports migrate to protocol 4 without testing buyer-writable report guesses; the authoritative trial/charge checks still run. Unauthenticated legacy plaintext is still refused. Fernet timestamps and runtime timing are observable metadata; this is not an anonymity guarantee. # Actor input Schema ## `baseline_json` (type: `string`): Required UTF-8 content; up to 256 KiB, never a path or download URL. ## `candidate_json` (type: `string`): Required UTF-8 content; up to 256 KiB, never a path or download URL. ## `consumers_json` (type: `string`): Required UTF-8 content; up to 256 KiB, never a path or download URL. ## Actor input object example ```json { "baseline_json": "{\n \"openapi\": \"3.1.0\",\n \"info\": {\"title\": \"Orders API\", \"version\": \"1.0.0\"},\n \"paths\": {\n \"/orders/{id}\": {\n \"get\": {\n \"parameters\": [{\"name\": \"id\", \"in\": \"path\", \"required\": true, \"schema\": {\"type\": \"string\"}}],\n \"responses\": {\"200\": {\"content\": {\"application/json\": {\"schema\": {\"type\": \"object\", \"properties\": {\"id\": {\"type\": \"string\"}, \"total\": {\"type\": \"number\"}}}}}}}\n }\n }\n }\n}\n", "candidate_json": "{\n \"openapi\": \"3.1.0\",\n \"info\": {\"title\": \"Orders API\", \"version\": \"1.1.0\"},\n \"paths\": {\n \"/orders/{id}\": {\n \"get\": {\n \"parameters\": [\n {\"name\": \"id\", \"in\": \"path\", \"required\": true, \"schema\": {\"type\": \"string\"}},\n {\"name\": \"tenant\", \"in\": \"header\", \"required\": true, \"schema\": {\"type\": \"string\"}}\n ],\n \"responses\": {\"200\": {\"content\": {\"application/json\": {\"schema\": {\"type\": \"object\", \"properties\": {\"id\": {\"type\": \"string\"}}}}}}}\n }\n }\n }\n}\n", "consumers_json": "{\n \"schema_version\": \"openapi-consumer-registry@1\",\n \"consumers\": [\n {\"consumer_id\": \"checkout\", \"criticality\": \"critical\", \"operations\": [\"GET /orders/{id}\"]},\n {\"consumer_id\": \"reporting\", \"criticality\": \"medium\", \"operations\": [\"GET /orders/{id}\"]}\n ]\n}\n" } ``` # Actor output Schema ## `reports` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "baseline_json": `{ "openapi": "3.1.0", "info": {"title": "Orders API", "version": "1.0.0"}, "paths": { "/orders/{id}": { "get": { "parameters": [{"name": "id", "in": "path", "required": true, "schema": {"type": "string"}}], "responses": {"200": {"content": {"application/json": {"schema": {"type": "object", "properties": {"id": {"type": "string"}, "total": {"type": "number"}}}}}}} } } } }`, "candidate_json": `{ "openapi": "3.1.0", "info": {"title": "Orders API", "version": "1.1.0"}, "paths": { "/orders/{id}": { "get": { "parameters": [ {"name": "id", "in": "path", "required": true, "schema": {"type": "string"}}, {"name": "tenant", "in": "header", "required": true, "schema": {"type": "string"}} ], "responses": {"200": {"content": {"application/json": {"schema": {"type": "object", "properties": {"id": {"type": "string"}}}}}}} } } } }`, "consumers_json": `{ "schema_version": "openapi-consumer-registry@1", "consumers": [ {"consumer_id": "checkout", "criticality": "critical", "operations": ["GET /orders/{id}"]}, {"consumer_id": "reporting", "criticality": "medium", "operations": ["GET /orders/{id}"]} ] }` }; // Run the Actor and wait for it to finish const run = await client.actor("biztoolsus/openapi-consumer-impact").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "baseline_json": """{ \"openapi\": \"3.1.0\", \"info\": {\"title\": \"Orders API\", \"version\": \"1.0.0\"}, \"paths\": { \"/orders/{id}\": { \"get\": { \"parameters\": [{\"name\": \"id\", \"in\": \"path\", \"required\": true, \"schema\": {\"type\": \"string\"}}], \"responses\": {\"200\": {\"content\": {\"application/json\": {\"schema\": {\"type\": \"object\", \"properties\": {\"id\": {\"type\": \"string\"}, \"total\": {\"type\": \"number\"}}}}}}} } } } } """, "candidate_json": """{ \"openapi\": \"3.1.0\", \"info\": {\"title\": \"Orders API\", \"version\": \"1.1.0\"}, \"paths\": { \"/orders/{id}\": { \"get\": { \"parameters\": [ {\"name\": \"id\", \"in\": \"path\", \"required\": true, \"schema\": {\"type\": \"string\"}}, {\"name\": \"tenant\", \"in\": \"header\", \"required\": true, \"schema\": {\"type\": \"string\"}} ], \"responses\": {\"200\": {\"content\": {\"application/json\": {\"schema\": {\"type\": \"object\", \"properties\": {\"id\": {\"type\": \"string\"}}}}}}} } } } } """, "consumers_json": """{ \"schema_version\": \"openapi-consumer-registry@1\", \"consumers\": [ {\"consumer_id\": \"checkout\", \"criticality\": \"critical\", \"operations\": [\"GET /orders/{id}\"]}, {\"consumer_id\": \"reporting\", \"criticality\": \"medium\", \"operations\": [\"GET /orders/{id}\"]} ] } """, } # Run the Actor and wait for it to finish run = client.actor("biztoolsus/openapi-consumer-impact").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}") for item in client.dataset(run.default_dataset_id).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "baseline_json": "{\\n \\"openapi\\": \\"3.1.0\\",\\n \\"info\\": {\\"title\\": \\"Orders API\\", \\"version\\": \\"1.0.0\\"},\\n \\"paths\\": {\\n \\"/orders/{id}\\": {\\n \\"get\\": {\\n \\"parameters\\": [{\\"name\\": \\"id\\", \\"in\\": \\"path\\", \\"required\\": true, \\"schema\\": {\\"type\\": \\"string\\"}}],\\n \\"responses\\": {\\"200\\": {\\"content\\": {\\"application/json\\": {\\"schema\\": {\\"type\\": \\"object\\", \\"properties\\": {\\"id\\": {\\"type\\": \\"string\\"}, \\"total\\": {\\"type\\": \\"number\\"}}}}}}}\\n }\\n }\\n }\\n}\\n", "candidate_json": "{\\n \\"openapi\\": \\"3.1.0\\",\\n \\"info\\": {\\"title\\": \\"Orders API\\", \\"version\\": \\"1.1.0\\"},\\n \\"paths\\": {\\n \\"/orders/{id}\\": {\\n \\"get\\": {\\n \\"parameters\\": [\\n {\\"name\\": \\"id\\", \\"in\\": \\"path\\", \\"required\\": true, \\"schema\\": {\\"type\\": \\"string\\"}},\\n {\\"name\\": \\"tenant\\", \\"in\\": \\"header\\", \\"required\\": true, \\"schema\\": {\\"type\\": \\"string\\"}}\\n ],\\n \\"responses\\": {\\"200\\": {\\"content\\": {\\"application/json\\": {\\"schema\\": {\\"type\\": \\"object\\", \\"properties\\": {\\"id\\": {\\"type\\": \\"string\\"}}}}}}}\\n }\\n }\\n }\\n}\\n", "consumers_json": "{\\n \\"schema_version\\": \\"openapi-consumer-registry@1\\",\\n \\"consumers\\": [\\n {\\"consumer_id\\": \\"checkout\\", \\"criticality\\": \\"critical\\", \\"operations\\": [\\"GET /orders/{id}\\"]},\\n {\\"consumer_id\\": \\"reporting\\", \\"criticality\\": \\"medium\\", \\"operations\\": [\\"GET /orders/{id}\\"]}\\n ]\\n}\\n" }' | apify call biztoolsus/openapi-consumer-impact --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "type": "http", "url": "https://mcp.apify.com/?tools=fetch-actor-details,biztoolsus/openapi-consumer-impact" } } } ``` The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer ` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations). ## OpenAPI specification Download the OpenAPI definition: https://api.apify.com/v2/actors/hGm0eh8AwOjuNVYIZ/builds/SOmujtCeBsFYUIVXB/openapi.json