The API quality platform for headless commerce

Your APIs made a promise.
We make sure they keep it.

APIpact snapshots your entire API surface, replays it after every change, and tells you — with AI-classified severity — exactly what broke before your customers find out. REST and GraphQL. Cloud or deep inside your private network.

Book a demo See how it works

REST APIs
GraphQL
Behind-firewall execution
CI/CD native
AI-assisted diffs

apipact — regression gateexecutor eu-dc-01 online

of endpoints snapshotted per run: 0s
of endpoints snapshotted per run
concurrent execution per batch: 0×
concurrent execution per batch
countries of ready-made test data: 0+
countries of ready-made test data
inbound firewall ports required: 0
inbound firewall ports required

The problem

Modern commerce runs on APIs nobody fully controls — and everybody gets blamed for.

Commerce engines, CMSs, search, pricing, promotions — each shipping on its own cadence, each able to change what your customers see without a single failing test. APIpact was built to close exactly this gap.

The build was green. The storefront is broken.

Schema checks and contract tests validate structure, not substance. A price turning from a number into a string passes every one of them — and takes down every typed client you have.

Your test environments are unreachable — by design.

The environments where regressions should be caught live behind firewalls that no SaaS can reach. So they don't get tested, and production becomes your staging environment.

Test data is a spreadsheet held together by hope.

Magic card numbers in a wiki, email verification skipped, OTP flows disabled in staging, addresses that fail validation in half your markets. Every flaky test traces back to data.

Content regression engine

A tripwire across your entire API surface — REST and GraphQL.

Snapshot

Capture a baseline of your entire API surface — bodies, status codes, headers, and timing down to DNS, TLS, and TTFB — across hundreds of endpoints or GraphQL queries in one run.

Compare

After any deploy, migration, or vendor release, replay the exact same requests and semantically diff every response against the baseline. Order-aware, type-aware, structure-aware.

Assess

AI classifies every change by severity — critical, warning, info — and explains the business impact in plain language. Train the engine on expected changes and the noise disappears.

Act

Fail the CI gate, create the JIRA ticket with the diff attached, notify the team. Or approve the change and promote a new baseline in one click.

GET /api/v2/products/sku-8841 — baseline v47 vs staging

{

"id": "sku-8841",

"name": "Trail Runner GTX",

- "price": 49.99,

+ "price": "49.99",CRITICAL · type change

"currency": "EUR",

+ "loyaltyPoints": 120,WARNING · new field

~ "updatedAt": …IGNORED · trained rule

"stock": 240

}

🤖 AI assessment

Price serialization changed from number to string. Typed storefront and mobile clients will fail to parse. Likely caused by decimal-handling change in the pricing service. Recommend blocking release.

IDENTICALMODIFIEDSTATUS_CHANGENEW_ERRORRESOLVED_ERROR

Remote executors

Test the APIs your firewall protects — without touching the firewall.

Your most important environments are the ones no SaaS can reach. APIpact executors run inside your network and reach out — so staging, pre-prod, and internal services get the same regression coverage as anything public.

Outbound HTTPS only

The executor polls the platform for jobs. Nothing listens, no port opens, no VPN, no IP whitelisting. If a browser can reach the internet from that network, an executor can run there.

Dumb by design

The executor is a stateless HTTP client: it receives a batch of requests, runs them against your internal APIs, returns the responses. All test logic stays in the platform — less inside your perimeter, less to audit.

Scoped like your organization

Executors attach at organization, brand, or user level — most specific wins. A shared datacenter executor for the org, one next to each brand's staging stack, a personal one on a developer's laptop hitting localhost.

Observable, always

Heartbeats, online/offline status, version, and job progress are tracked live in the console. A silent executor is a visible incident, not a mystery.

The test data vault

Every flaky e-commerce test is a data problem. We industrialized the data.

Stop maintaining magic numbers in spreadsheets. APIpact ships a managed, brand-scoped, API-queryable library of everything a commerce test needs — provisioned, encrypted, and always current.

Payment cards

Every network, every outcome: success, decline, insufficient funds, invalid CVV, expired, fraud block, 3DS challenge, processor error. Stripe, CyberSource, and generic gateway variants — ask for a behavior, get a card.

Test customers with live inboxes

Bulk-generate customer identities with real, receivable mailboxes on our test domain. Registration emails, order confirmations, password resets — your automation reads them via API and asserts on content.

Automated activation & password-reset testing

Every test customer's live inbox is more than a viewer — APIpact reads the account-activation link or password-reset token straight out of the message and drives the flow to completion, so the whole verification path is asserted end-to-end with zero custom scripting. A capability we haven't seen matched elsewhere.

Virtual phones for OTP & SMS

Real provisioned phone numbers with API-readable inboxes. Test 2FA, one-time passcodes, and delivery notifications end-to-end instead of switching them off in staging.

International addresses

Validation-correct addresses for 16+ countries — proper postal formats, region names, phone patterns, and character sets from Czech diacritics to Cyrillic. Checkout tests that pass in every market you sell in.

Payment provider accounts

Sandbox credentials for Stripe, PayPal, Klarna, Adyen, Apple Pay, Google Pay, and a dozen more — stored encrypted with AES-256-GCM, scoped per brand, and served to tests on demand.

Coupons, products & shipping

The rest of the commerce domain, ready to inject: discount codes with known behaviors, catalog fixtures, and shipping method matrices — brand-scoped so parallel teams never collide.

Test flows

Whole customer journeys, not just single endpoints.

Real bugs live between requests: the cart that loses its coupon at checkout, the OTP that never arrives, the order confirmation that references the wrong total. APIpact test flows chain API calls into full journeys — built on the open Arazzo workflow standard.

Variables flow between steps — an ID created in step one drives step five
Steps pull live test data: cards by expected outcome, customers with inboxes, OTP numbers
Conditional logic and per-step assertions with full timing capture
Versioned definitions with draft / ready / archived lifecycle
Executed in the cloud or through a remote executor behind your firewall

flow: guest-checkout-3ds.yaml

RUNNING

✓
createCartPOST /carts
cartId → $steps.createCart.id
✓
addItemPOST /carts/{cartId}/items
uses test product SKU-8841
✓
applyCouponPOST /carts/{cartId}/coupons
coupon WELCOME10 from data vault
4
checkoutPOST /checkout
card: REQUIRES_3DS from card library
5
verifyOtpreads SMS inbox +1 415 555-0182
asserts order status = CONFIRMED

AI throughout

Intelligence where it counts: separating signal from noise.

The reason most diff-based testing dies is that everything changes a little. APIpact applies AI at every stage — scoring specs, enriching documentation, generating fuzz inputs, and above all deciding which of your 3,000 diff lines is the one that costs money.

Trainable diff engine

Approve an expected change once — a rotating timestamp, an A/B flag, a cache header — and the engine learns the rule. Week one you review diffs; week two you only see surprises.

OpenAPI quality scoring

Import a spec and get a graded report (0–100, A–F) across documentation, schemas, examples, security definitions, and error coverage — with concrete recommendations to fix each gap.

Spec enrichment

AI fills in what your OpenAPI spec is missing: parameter descriptions, realistic example values, refined schemas. Turn a bare spec into living documentation.

Ghost endpoint detection

The spec says 312 endpoints; your tests cover 240. APIpact finds the other 72 — the ghost endpoints shipping to production with zero coverage — and prioritizes them for you.

Fuzz dictionary generation

AI generates targeted fuzzing inputs per endpoint — boundary values, injection patterns, malformed payloads — tailored to your actual parameter schemas.

Plain-language assessments

Every detected change comes with an AI explanation of what changed, why it probably changed, and who it will hurt — readable by a product manager, not just a QA engineer.

API Spec Quality Score

Documentation: 92
Schema definitions: 88
Example coverage: 71
Error responses: 64
Security definitions: 95

Generated automatically on every spec import, with AI recommendations for each category.

CI/CD native

A regression gate in every pipeline. Three API calls. That's it.

Trigger a snapshot when you bless a build. Trigger a comparison on every deploy. Fail the pipeline on critical changes. The public REST API works from GitHub Actions, GitLab CI, Jenkins, or a cron job on a Raspberry Pi.

Named API keys per organization — SHA-256 hashed, never stored in plaintext
Poll execution status and get full diff summaries as JSON
Severity-based gating: fail on critical, ticket on warning, ignore info
JIRA tickets created automatically from failures, diff attached
Works with remote executors — gate staging deploys behind the firewall

.github/workflows/deploy.yml

- name: API regression gate
  run: |
    curl -X POST \
      -H "Authorization: Bearer ${{ secrets.APIPACT_API_KEY }}" \
      https://console.apipact.dev/api/public/v1/
        content-regression/rest/$TEST_ID/comparison

# pipeline output:
    ✓ 309 endpoints identical
    ✗ 1 CRITICAL change — blocking deploy
    → JIRA QA-1204 created with full diff

Deploy blocked · price regression never reached production

Plays well with your stack

Standards in, integrations out

JIRAtickets from failures

GitHub Actionspipeline gates

OpenAPI 2.0 / 3.1spec import & scoring

Arazzoworkflow standard

Twiliovirtual phones & SMS

Mailguntest customer inboxes

Stripepayment sandboxes

GraphQLquery regression

Google / GitHub / BitbucketSSO sign-in

OpenAIAI assessments

Built for the whole team

One platform, three audiences convinced.

For QA leads

Coverage you can finally see.

Ghost endpoint detection shows exactly what isn't tested
Every execution attributed, auditable, and filterable
Brand and environment scoping mirrors how your teams actually work
Multi-tenant with role-based access — OWNER to VIEWER

For engineers

Automation-first, UI second.

Everything triggerable via public REST API with scoped keys
Arazzo-standard flows — no proprietary DSL lock-in
Executors run anywhere: laptop, CI runner, Kubernetes
Timing metrics down to DNS, TLS handshake, and TTFB

For the business

Incidents that never happened.

Catch content regressions before customers and revenue feel them
AI assessments readable by non-engineers — impact, not JSON paths
One platform replacing diff scripts, data spreadsheets, and manual smoke tests
Enterprise-grade isolation: AES-256-GCM encryption, org-level tenancy

FAQ

Questions we hear in every first call

What is API content regression testing?

Content regression testing captures a baseline snapshot of your real API responses — bodies, status codes, headers, timing — and semantically compares every subsequent run against it. Unlike contract or schema tests, it catches changes in the actual data: type changes, missing content, wrong values, new error states. APIpact classifies each change by severity and explains its impact with AI.

How do you test APIs that aren't reachable from the internet?

Through remote executors: a lightweight agent you run inside your private network. It polls the APIpact cloud for jobs over outbound HTTPS only — no inbound firewall rules, no VPN, no IP whitelisting. The executor runs the requests against your internal APIs and streams results back. Executors can be scoped to your organization, a specific brand, or an individual user.

Does APIpact support GraphQL?

Yes. GraphQL regression testing works on curated query collections: each named query plus variables is snapshotted and compared exactly like a REST endpoint, with GraphQL-specific handling for partial errors, list ordering, and nullable cascades. REST and GraphQL share the same baselines workflow, severity model, and dashboards.

How does APIpact integrate with CI/CD?

Via a public REST API authenticated with scoped API keys. Trigger snapshots and comparisons from GitHub Actions, GitLab CI, Jenkins, or any script; poll for results; and gate deployments on severity — for example, fail the pipeline on any critical change. Failures can automatically create JIRA tickets with the full diff attached.

What test data does the platform provide?

A brand-scoped, API-queryable vault: payment cards covering every outcome (success, decline, 3DS, fraud, processor error) across all major networks; payment provider sandbox accounts stored with AES-256-GCM encryption; generated test customers with real receivable email inboxes; virtual phone numbers for OTP and SMS testing; validation-correct addresses for 16+ countries; plus coupons, products, and shipping methods.

How do you keep diff noise under control?

The regression engine is trainable. When you approve an expected change — a timestamp, a request ID, an A/B flag — it becomes an ignore rule applied to future comparisons. Combined with AI severity classification, this means the gate only trips on genuine surprises, which is what keeps regression gates from being disabled by frustrated teams.

Is APIpact multi-tenant and enterprise-ready?

Yes. Organizations are fully isolated, users can belong to several organizations with role-based access (OWNER, ADMIN, MEMBER, VIEWER), and data is scoped per brand and per environment. Credentials are encrypted with AES-256-GCM, API keys are SHA-256 hashed, and enterprise plans add SSO/SAML, custom limits, and SLAs.

We're not sure our case fits — can the platform be tailored?

That's exactly how we like to work. The platform is broad — regression, flows, test data, executors, AI tooling — and every engagement starts with your concrete cases: which APIs, which environments, which pain. Book a call and we'll map your scenario onto the platform, including custom integrations where needed.

Tell us what keeps breaking.
We'll show you how it stops.

Every team's API landscape is different — that's why we start with your cases, not a feature tour. Bring one painful incident to the call; we'll map the workflow that would have caught it.

Book a demo call support@apipact.dev

30 minutes · your use cases, not our slides · technical questions welcome

Your APIs made a promise.We make sure they keep it.