Documentação

Inspect API discovery

Discover project routes, review their provenance and keep Collections in sync.

Nesta página

Turn a project into an API collection

TDE Inspect can discover HTTP endpoints from a registered Project or any local folder and import them into a native Collection. The scan is read-only: it does not execute repository code, install dependencies, start a server, follow remote $ref values or send application requests.

Open TDE Inspect, choose Discover APIs, then select a Project or folder. The wizard scans, lets you review the evidence and imports only the operations you select.

What discovery reads

Sources are considered in this order:

OpenAPI 3.0/3.1 and Swagger 2.0 files.
An already-resolved loopback task runtime, when the host supplies one.
Static route registrations in source code.

Static adapters cover Express, Fastify, Nest, Hono, Next Route Handlers, FastAPI, Flask, Rails, Sinatra, Go net/http and common routers, plus Axum, Actix and Rocket-style Rust routes. Findings with the same method and normalized path are consolidated. A contract outranks static analysis, while the lower-confidence source remains attached as corroborating evidence.

Local OpenAPI references are resolved within strict byte and depth limits. Remote references are reported as fidelity losses rather than fetched. Proven parameters, request bodies, response examples, content types and auth schemes are retained; missing evidence is never invented.

Review before import

Review is a Collection → folder → request tree. Use the mouse or Arrows/Space/Enter/Esc to select whole branches or individual endpoints. Filters for method, folder, confidence and origin narrow the view without changing the selection.

The focused request shows its adapter and file:line provenance. Import creates:

native request and folder records;
a {{base_url}} collection variable;
proven parameters, body and response metadata;
empty Vault-backed credential slots for proven auth schemes.

The Collection is written atomically. If the write fails, Inspect restores the complete pre-import state.

Rescan without losing manual work

An imported Collection stores a versioned baseline: source root, Project ID, source hash, files, adapters, generated operations and operation fingerprints. Choose Rescan to compare the repository with that baseline.

The review shows New, Changed and No longer detected operations. New endpoints start selected. Missing endpoints are warnings and are never automatically deleted. A generated field is updated only while its current value still matches the previous generated value, so manual URLs, headers, bodies, secrets and environments survive rescans.

Accepting or rejecting a finding advances the baseline. A deliberately rejected endpoint therefore does not return as New on every scan.

Bounds and diagnostics

The default scan limits are 20,000 files, 16 MiB per file, 256 MiB total source bytes, 64 directory levels and 10,000 operations. .gitignore is honored; .git, dependency, vendor and build-output directories are excluded.