Open sourceMITLocal-firstv0.12.1
APIWeave is an open-source visual API testing tool for Windows, macOS, and Linux. Connect requests, extract response data, and add assertions to build multi-step test workflows that run on your machine — without a required account.
API tests you can watch run — every node lights up as it executes.
Windows · macOS · Linux — no account required
A 76-second tour cut from real recordings of the app. Unmute for the soundtrack.
Worked example
A workflow is the test: nodes wired in order, each one building on the response before it. This is the loop APIWeave is built around.
POST credentials to the login endpoint and let the workflow keep the response.
A JSONPath extractor pulls the token out of the response and stores it as a variable.
The following request sends it as a bearer header, so nothing is copy-pasted between runs.
Check the status, a header, a cookie, or a value in the body — a broken contract fails the run.
Open the run's timeline and click the red bar: every rule the assertion checked, with its expected and actual value.
43 seconds, in the order of the built-in tutorial: import ShopFlow's OpenAPI spec → the Log in request, its password a {{secrets.SHOPFLOW_PASSWORD}} reference → extract the returned token into {{variables.token}} and send it as a bearer header → local and staging environments → inventory and pricing in parallel, joined by Merge → an assertion on the 141.30 total → all 19 steps green. Captured from the desktop app.
Here the demo API applies the WEAVE10 discount twice. The assertion Total is 141.30 turns red and the run never takes its pass branch. In the run timeline, its node card lists every rule with what it compared: status, discount code and subtotal pass, and body.total expected 14130 but got 12560.
This loop is the whole tool in miniature. The request-chaining guide covers extractor paths, post-merge branch indexing, and how to reuse the login as its own step.
API testing features
Every visual here is the actual app. The colors are the app's own language: HTTP verbs, running amber, passing green, failing red.
Drag nodes onto the dot grid, wire them with bezier edges, and let the 700ms autosave do the saving. Workflows open as tabs; the minimap keeps big graphs navigable; JSON view is one click away.
Eleven operators over status, headers, cookies, variables and the previous response — with pass and fail edges, so a broken contract takes its own path through the graph. The run timeline records each rule's expected and actual value.
An embedded terminal puts a coding agent beside the canvas, driving APIWeave over MCP: diagnose a failed run, patch the graph under a revision guard, and watch the change land live. It launches whichever CLI you already have installed.
Opt-in and loopback only: 54 tools over 127.0.0.1, one bearer token per install, and a secret surface that returns names and scopes but never a value. Off by default — nothing listens until you ask.
The timeline lays every node out as a waterfall — parallel branches overlap and Merge waits for both. Click a bar for its status, duration, start and finish. A failed run ends at the red bar where it stopped, and that bar's card shows why: each assertion rule with its expected and actual value.
JSONPath extractors chain responses into the next request, and the panel traces every value back to the node that produced it. Environments scope the values, and inheritance stacks them (base → staging → staging-eu).
Values are sealed into an encrypted store on your machine. Workflows reference {{secrets.*}}, the store is write-only at rest, and runs are masked before history is written. A workspace synced through git carries the reference, never the value.
An SSE Stream node holds the subscription open while the rest of the graph runs: its Ready edge fires the request that triggers the events, a finish rule such as event equals order.shipped closes it, and every collected event lands in its output for assertions.
Requests added from an OpenAPI spec remember their operation. Refresh the spec and a request whose endpoint moved gets a Check API badge naming the old and new path.
Drop a specification, get a workflow
Import OpenAPI and Swagger definitions as ready-to-run request nodes, replay browser sessions from HAR, and paste a cURL command straight onto the canvas.
Local-first
APIWeave sends every request and evaluates every assertion on your machine, against your own environments. Install it, open the canvas, and run — there is nothing to sign up for and no telemetry.
What exactly stays on your machine? The local API testing guide sets out the boundary in full, including the one thing a “stays local” claim usually gets wrong.
Getting started
Three moves — assemble the graph, run it against an environment, inspect every result — then keep the workspace in a git repo you own.
Drag requests, assertions, delays and merges onto the canvas. Wire the branches, set expected statuses, extract what the next node needs. It autosaves as you go, and the built-in tutorials walk you through each step beside the canvas.
Pick an environment and press run. Requests fire along the edges, variables resolve, and the camera follows the active branch so you never lose the thread.
The timeline replays the run as a waterfall — every branch, every delay, every extraction, laid out on one clock. Open any node for its request, response and assertions.
Gallery
Every frame below is a real capture of the desktop app in dark mode, running against the ShopFlow demo API.
Questions
What the tool is, what it runs, and how a workspace moves between machines — in plain terms.
It means building an API test as a graph instead of a script. Each node is a step — an HTTP request, an assertion, a delay, a merge, or a call to another workflow — and the edges are the order the run follows. You assemble the test on a canvas, then watch it execute node by node.
Yes. Requests run in graph order, so one response can feed the next. A typical workflow logs in, extracts the returned token, and sends it as a bearer header on the following request — no copy-pasting between runs.
Yes. JSONPath extractors pull values out of a response — a token, an ID, a total — and store them as variables that later nodes reference. The variables panel traces each value back to the node that produced it.
No. APIWeave is local-first: you install the desktop app and build, run, and store workflows with no account at all. To move a workspace between machines you connect a git remote you own — such as a GitHub or GitLab repository — so syncing needs no APIWeave account either.
Windows, macOS, and Linux. The desktop app ships installers for all three. Git sync needs the git command installed on the machine; a workspace that stays local runs without it.
OpenAPI 3.x and Swagger 2.0 definitions import as ready-to-run request nodes, HAR files replay a recorded browser session, and you can paste a cURL command straight onto the canvas.
A tracked workspace is written to a git repository on your machine as a tree of JSON files, and every change becomes a commit. Connect a remote and the app fetches, integrates, and pushes on its own; in manual mode it waits for Sync now. The history lives on the git host you chose, and the app only speaks plain git to it.
The repository holds the workspace, its projects, its workflows, and its workspace environments with their plain variables. Workflows keep the {{secrets.NAME}} references you wrote, so it says which secrets a workflow needs. Secret values and their ciphertext, the secret store itself, run history and response bodies are never written to it. Request definitions are, because they are the workflow; a credential typed into a request or a variable is withheld as <SECRET>, or a secret-named header is left out.
Not through git. The repository carries secret references such as {{secrets.apiToken}}, never the values behind them, and CI supplies each value as an environment variable. When a workflow uses a secret, the value is sent to the API under test as part of that request — from the machine running it.
APIWeave merges by record, node and field. Changes that do not overlap are combined in a real merge commit; where the same field changed differently, nothing is pushed or imported until you pick Your copy or Remote copy for it. A merge that waits survives quitting the app.
Yes, if they can read the repository. In the workspace switcher they choose Open from git…, paste the URL, and the app clones it, imports the workspace, and tracks it in auto mode. They set their own secret values, because none are in the repository.
A workspace syncs one branch, with no branch picker and no pull requests from the app. Environment inheritance is not carried into the repository, and a workflow's own version history in the app stays separate from git history.
Yes. The desktop app is public on GitHub, free to use under the MIT licence, and runs without a required account.
Install the app, open the canvas, and watch your first API test workflow go green. No account, no configuration, no telemetry.
MIT · local-first · Windows, macOS, Linux
Not sure which build you need? The download page lists the artifact for each platform and the one caveat that applies to it.