Third-party API Contract Drift Monitor

Check a third-party API's documented GET contract in one Apify Run. The Actor reads an OpenAPI 3 document, calls a bounded set of GET endpoints, validates the expected status and the documented JSON response schema, and returns a machine-readable mismatch report.

Quick start

Provide either specUrl or an inline spec, plus baseUrl when the OpenAPI document does not contain servers.

{
  "specUrl": "https://api.example.com/openapi.json",
  "baseUrl": "https://api.example.com",
  "endpointPaths": ["/health", "/v1/status"],
  "maxEndpoints": 10,
  "stateId": "production-api"
}

The output contains one endpoint-check row per selected GET endpoint and one run-summary row. Each check contains sourceUrl, retrievedAt, outcome, status, schema failures, and a fingerprint. A scheduled run uses stateId to distinguish baseline, unchanged, and changed.

Schedule a recurring check

1. Run the Actor once with a stable stateId and confirm the baseline output.
2. Create an Apify Schedule for this Actor and keep the same input and stateId.
3. Start daily or weekly, then inspect changeType: changed and the run-summary counters.

The Actor does not run its own cron loop. The Schedule owns recurrence and the named Key-Value Store holds the previous fingerprints. Changing stateId starts a new baseline. Named-store storage is charged to the Actor user by the platform.

Safety and terms boundary

• Use only public URLs or APIs you are authorized to access.
• This first version sends GET only. It does not create, update, or delete remote data.
• It does not bypass login, CAPTCHA, robots restrictions, or rate limits.
• 403 is reported as blocked, 404 as missing, and timeouts/5xx/429 as failed.
• Request headers are accepted for an authorized API, but sensitive header values are redacted from output and logs.
• Response bodies are used for validation and are not written to the Dataset.

Pricing design for validation

Candidate unit: one successfully schema-checked endpoint.

Failed, blocked, missing, and schema-failing requests are not billable. The public build calls one contract-checked event per successful schema-checked endpoint, with a run-scoped idempotency key. The initial configuration is USD 0.01 per event with a USD 0.01 minimum maximum total charge per run.

MVP non-goals

Webhook ingestion, POST/PUT/PATCH/DELETE operations, browser automation, proxy rotation, account creation, dashboard UI, LLM summaries, and customer-specific integrations are intentionally excluded.

Local verification

npm test
npm run check