# Third-party API Contract Drift Monitor (`invaluable_rondeau/third-party-api-contract-drift-monitor`) Actor

Check authorized GET endpoints against an OpenAPI contract and report machine-readable schema drift in one run.

- **URL**: https://apify.com/invaluable\_rondeau/third-party-api-contract-drift-monitor.md
- **Developed by:** [PROOFNEXA](https://apify.com/invaluable_rondeau) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$10.00 / 1,000 successful contract checks

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Third-party API Contract Drift Monitor

Check a third-party API's documented GET contract in one Apify Run. The Actor reads an OpenAPI 3 document, calls a bounded set of GET endpoints, validates the expected status and the documented JSON response schema, and returns a machine-readable mismatch report.

### Quick start

Provide either `specUrl` or an inline `spec`, plus `baseUrl` when the OpenAPI document does not contain `servers`.

```json
{
  "specUrl": "https://api.example.com/openapi.json",
  "baseUrl": "https://api.example.com",
  "endpointPaths": ["/health", "/v1/status"],
  "maxEndpoints": 10,
  "stateId": "production-api"
}
```

The output contains one `endpoint-check` row per selected GET endpoint and one `run-summary` row. Each check contains `sourceUrl`, `retrievedAt`, `outcome`, status, schema failures, and a fingerprint. A scheduled run uses `stateId` to distinguish `baseline`, `unchanged`, and `changed`.

### Schedule a recurring check

1. Run the Actor once with a stable `stateId` and confirm the baseline output.
2. Create an Apify Schedule for this Actor and keep the same input and `stateId`.
3. Start daily or weekly, then inspect `changeType: changed` and the `run-summary` counters.

The Actor does not run its own cron loop. The Schedule owns recurrence and the named Key-Value Store holds the previous fingerprints. Changing `stateId` starts a new baseline. Named-store storage is charged to the Actor user by the platform.

### Safety and terms boundary

- Use only public URLs or APIs you are authorized to access.
- This first version sends GET only. It does not create, update, or delete remote data.
- It does not bypass login, CAPTCHA, robots restrictions, or rate limits.
- 403 is reported as `blocked`, 404 as `missing`, and timeouts/5xx/429 as `failed`.
- Request headers are accepted for an authorized API, but sensitive header values are redacted from output and logs.
- Response bodies are used for validation and are not written to the Dataset.

### Pricing design for validation

Candidate unit: one successfully schema-checked endpoint.

Failed, blocked, missing, and schema-failing requests are not billable. The public build calls one `contract-checked` event per successful schema-checked endpoint, with a run-scoped idempotency key. The initial configuration is USD 0.01 per event with a USD 0.01 minimum maximum total charge per run.

### MVP non-goals

Webhook ingestion, POST/PUT/PATCH/DELETE operations, browser automation, proxy rotation, account creation, dashboard UI, LLM summaries, and customer-specific integrations are intentionally excluded.

### Local verification

```bash
npm test
npm run check
```

# Actor input Schema

## `specUrl` (type: `string`):

Public or explicitly authorized URL returning an OpenAPI JSON document.

## `spec` (type: `object`):

Optional inline OpenAPI 3 document. Use specUrl or spec, not both.

## `baseUrl` (type: `string`):

Optional base URL. If blank, the first OpenAPI servers.url value is used.

## `headers` (type: `object`):

Optional headers for an API you are authorized to access. Secrets are never written to output.

## `endpointPaths` (type: `array`):

Optional OpenAPI paths to check. Blank checks GET paths up to maxEndpoints.

## `maxEndpoints` (type: `integer`):

Safety limit for one run.

## `timeoutMs` (type: `integer`):

Maximum time to wait for one authorized GET request.

## `maxRetries` (type: `integer`):

Retries transient 429 and 5xx responses and network timeouts.

## `stateId` (type: `string`):

Keep stable for scheduled runs. A new value starts a new baseline.

## Actor input object example

```json
{
  "maxEndpoints": 10,
  "timeoutMs": 10000,
  "maxRetries": 2,
  "stateId": "default"
}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("invaluable_rondeau/third-party-api-contract-drift-monitor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("invaluable_rondeau/third-party-api-contract-drift-monitor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call invaluable_rondeau/third-party-api-contract-drift-monitor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,invaluable_rondeau/third-party-api-contract-drift-monitor"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/Z5rh5oih4KkLI5PNg/builds/UX7eL3KVRpfAJ3jWc/openapi.json