APIScout
This sheet summarizes value, pricing and use cases. From here you can move to the dedicated areas or to the client portal for the next action.
All-in-one API testing and observability platform: combines testing (like Postman/Insomnia), monitoring (like Datadog), security scanner, and AI automation. Replaces 3-4 separate tools, running as self-hosted on your infrastructure.
What it solves
- 3-4 separate tools for testing, monitoring, security and reporting
- SaaS costs for host/user that explode (Postman, Datadog)
- Nessun monitoraggio proattivo: le anomalie si scoprono tardi
- API security not integrated into the lifecycle
APIScout is a unique platform for the entire API lifecycle: from building and testing requests, to continuous monitoring in production, through security scanning and automation. It is fully installed on your infrastructure, so your data and credentials do not leave your perimeter. It is proprietary software by Objlab S.r.l., licensed for use.
What it does
APIScout replaces the typical "Postman + Datadog + separate scanner" stack with a single application. Build and organize requests, run them in batch, monitor endpoints and workflows over time, receive alerts on anomalies, and generate reports, all from the same interface.
| Module | What it does |
|---|---|
| API Testing | Request builder, collections, environments, variables, response inspection, batch test |
| Monitoring & Observability | Scheduled synthetic checks, health/uptime, distributed tracing, log aggregation, dependency map |
| Security | Security scanner on responses: headers, sensitive data, TLS, CORS with 0-100 scoring |
| Automation | Pipeline, multi-channel alerting, anomaly detection, SLA and cost tracking |
| Integrations | Import/export cURL, OpenAPI, Postman; export metrics to Prometheus; plugin SDK; CI/CD via CLI |
Key Features
- Complete request builder with collections, environments and reusable variables.
- Bidirectional import/export to cURL, OpenAPI 3.x and Postman collection.
- Synthetic monitoring with integrated scheduler (APScheduler) for periodic uptime and health checks.
- Distributed tracing, log aggregation and map of dependencies between endpoints.
- Anomaly detection on metrics and multi-channel alerting (configurable notification channels).
- Security scanner of responses: missing recommended headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), permissive CORS, server fingerprint, endpoints in unencrypted HTTP and detection of sensitive data (JWT, Stripe/AWS/Google/GitHub/Slack API keys, Luhn validated credit card numbers, clear text password/secret fields, potential PII leak).
- Synthetic security score from 0 to 100 for each analyzed response.
- Smart Compose: request suggestions based on a textual description, derived from history and saved requests (rule-based, no data sent to external services).
- SLA and cost tracking, automation pipeline and batch testing.
- Export of metrics in Prometheus format (
/metrics) and plugin SDK to extend tests, exporters and integrations (e.g., export collection as Markdown). - Modern React web console with dashboards and real-time graphs; optional Qt5 desktop thin-client for internal use.
Architecture
APIScout adopts a service-oriented architecture with a SPA web as the primary client. The backend is in Python using FastAPI + Pydantic v2 served by Uvicorn, with JWT (python-jose + bcrypt) authentication and exposing REST + WebSocket. Persistence is on PostgreSQL, with ORM SQLAlchemy 2.x and migrations managed via Alembic. The frontend is a Single Page Application built with React 18 + TypeScript using Vite, UI in MUI, data-fetching with TanStack Query, routing with React Router, state with Zustand and visualizations with Recharts and React Flow. Synthetic check scheduling uses APScheduler; there is a Prometheus endpoint for scraping metrics. Deployment occurs in native mode (venv) for development or via Docker Compose (PostgreSQL + backend + frontend + nginx as reverse proxy) for a complete stack.
Requirements
- Operating system: Linux, Windows or macOS (deploy recommended via Docker).
- Runtime: Python 3.10+ and Node.js 18+ (for build/development of the frontend).
- Database: PostgreSQL 14+ (target 16).
- Main backend dependencies: FastAPI, Uvicorn, SQLAlchemy 2.x, Alembic, Pydantic v2, psycopg 3, python-jose, passlib/bcrypt, APScheduler, requests, PyYAML, psutil.
- Optional: Docker + Docker Compose for the full stack; PyQt5 only for the internal desktop thin-client.
Compliance & regulations
OWASP Secure Headers Project
Lo scanner controlla la presenza di HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy e Permissions-Policy nelle response, segnalando quelli mancanti con relativa severita'.
OWASP API Security Top 10 (aree)
Controlli su aree tipiche della OWASP API Security Top 10: Security Misconfiguration (CORS permissivo, server fingerprint, HTTP non cifrato) ed esposizione di dati sensibili (JWT, chiavi API, numeri di carta, credenziali, PII).
Reports & dossiers
- Security Scan ReportJSON
Finding per categoria e severita' (critical/high/medium/low), con punteggio di sicurezza 0-100 e riepilogo per severita' di una response API.
- Export collectionPostman / OpenAPI 3.x / cURL / Markdown
Esportazione delle richieste e collection nei formati standard per condivisione, documentazione o riuso.
- Metriche PrometheusTesto (formato Prometheus)
Endpoint /metrics per lo scraping delle metriche operative da Prometheus e tool di observability esterni.
- SLA & Cost SummaryJSON
Stato di conformita' degli SLA definiti e riepilogo dei costi/chiamate per il tracking dei livelli di servizio.
Try it
Frequently asked questions
A che cosa serve APIScout?
A provare le API, tenerle sotto osservazione e produrre reportistica su come si comportano nel tempo. Non è solo uno strumento di collaudo: la parte di monitoraggio continua serve a sapere che un'integrazione ha smesso di funzionare prima che lo dica un cliente.
In che stato è il prodotto?
APIScout is being refactored towards an architecture with PostgreSQL, REST API, and web interface: during the transition, parts of the previous system coexist. We say this first rather than later because those evaluating a platform need to know whether they are looking at a static product or one in motion.
Serve installare qualcosa sulle postazioni?
No: the interface used by customers is web-based. There is also a desktop console, but it is an internal tool and not the intended path for those adopting the product.
Use cases
MSP: monitoring API centralizzato dei clienti
Una sola piattaforma per testare e monitorare le API di tutti i clienti.
DevOps: anomaly detection sulle API
Rilevamento ML delle anomalie con alerting multi-canale.