Catch drift between the spec and what ships
Link your OpenAPI 3 or Swagger 2 spec: calls that break it show SPEC MISMATCH with the reason, undocumented calls show NOT IN SPEC, and coverage counts the operations a test touched. Without a spec, SCHEMA CHANGED still marks an answer whose JSON shape changed. How to check against OpenAPI.
Send, chain and sign
Compose with environments and secret variables, chain values from one answer into the next request, and sign with OAuth 2.0, AWS Signature v4 or an HMAC preset. Import your Postman, Insomnia, Bruno or Hoppscotch collections, or the spec itself, from a file, a folder or a URL, and export collections back out for Bruno, Insomnia or Hoppscotch. Send QUERY requests, sign in with OAuth device code, call SOAP services from a WSDL, or send gRPC-Web and Connect from your own .proto files.
Load tests from real traffic
Performance turns a recording into a k6, JMeter, Gatling or Locust script, with each endpoint's measured p95 latency as its pass/fail threshold. The command-line tool has its own local load test too. How to run checks in CI.
Passive security checks
Every answer is read for problems such as a token in a URL query, a JWT with alg "none", wildcard CORS with credentials, or card numbers in a response, and flagged SECURITY. These checks only read what was captured; nothing extra is sent.