Open sourceMITLocal-firstv0.12.1
APIWeave is an open-source visual API testing tool for Windows, macOS, and Linux. Connect requests, extract response data, and add assertions to build multi-step test workflows that run on your machine — without a required account.
API tests you can watch run — every node lights up as it executes.
Windows · macOS · Linux — no account required
A 76-second tour cut from real recordings of the app. Unmute for the soundtrack.
Worked example
A workflow is the test: nodes wired in order, each one building on the response before it. This is the loop APIWeave is built around.
POST credentials to the login endpoint and let the workflow keep the response.
A JSONPath extractor pulls the token out of the response and stores it as a variable.
The following request sends it as a bearer header, so nothing is copy-pasted between runs.
Check the status, a header, a cookie, or a value in the body — a broken contract fails the run.
Open the run's timeline and click the red bar: every rule the assertion checked, with its expected and actual value.
43 seconds, in the order of the built-in tutorial: import ShopFlow's OpenAPI spec → the Log in request, its password a {{secrets.SHOPFLOW_PASSWORD}} reference → extract the returned token into {{variables.token}} and send it as a bearer header → local and staging environments → inventory and pricing in parallel, joined by Merge → an assertion on the 141.30 total → all 19 steps green. Captured from the desktop app.
Here the demo API applies the WEAVE10 discount twice. The assertion Total is 141.30 turns red and the run never takes its pass branch. In the run timeline, its node card lists every rule with what it compared: status, discount code and subtotal pass, and body.total expected 14130 but got 12560.
This loop is the whole tool in miniature. The request-chaining guide covers extractor paths, post-merge branch indexing, and how to reuse the login as its own step.
API testing features
Every visual here is the actual app. The colors are the app's own language: HTTP verbs, running amber, passing green, failing red.
Drag nodes onto the dot grid, wire them with bezier edges, and let the 700ms autosave do the saving. Workflows open as tabs; the minimap keeps big graphs navigable; JSON view is one click away.
Eleven operators over status, headers, cookies, variables and the previous response — with pass and fail edges, so a broken contract takes its own path through the graph. The run timeline records each rule's expected and actual value.
An embedded terminal puts a coding agent beside the canvas, driving APIWeave over MCP: diagnose a failed run, patch the graph under a revision guard, and watch the change land live. It launches whichever CLI you already have installed.
Opt-in and loopback only: 54 tools over 127.0.0.1, one bearer token per install, and a secret surface that returns names and scopes but never a value. Off by default — nothing listens until you ask.
The timeline lays every node out as a waterfall — parallel branches overlap and Merge waits for both. Click a bar for its status, duration, start and finish. A failed run ends at the red bar where it stopped, and that bar's card shows why: each assertion rule with its expected and actual value.
JSONPath extractors chain responses into the next request, and the panel traces every value back to the node that produced it. Environments scope the values, and inheritance stacks them (base → staging → staging-eu).
Values are sealed into an encrypted store on your machine. Workflows reference {{secrets.*}}, the store is write-only at rest, and runs are masked before history is written. Cloud carries the reference, never the value.
An SSE Stream node holds the subscription open while the rest of the graph runs: its Ready edge fires the request that triggers the events, a finish rule such as event equals order.shipped closes it, and every collected event lands in its output for assertions.
Requests added from an OpenAPI spec remember their operation. Refresh the spec and a request whose endpoint moved gets a Check API badge naming the old and new path.
Drop a specification, get a workflow
Import OpenAPI and Swagger definitions as ready-to-run request nodes, replay browser sessions from HAR, and paste a cURL command straight onto the canvas.
Local-first
APIWeave sends every request and evaluates every assertion on your machine, against your own environments. Install it, open the canvas, and run — there is nothing to sign up for and no telemetry.
What exactly stays on your machine? The local API testing guide sets out the boundary in full, including the one thing a “stays local” claim usually gets wrong.
Getting started
Three moves — assemble the graph, run it against an environment, inspect every result — whether the workflow has five nodes or fifty.
Drag requests, assertions, delays and merges onto the canvas. Wire the branches, set expected statuses, extract what the next node needs. It autosaves as you go, and the built-in tutorials walk you through each step beside the canvas.
Pick an environment and press run. Requests fire along the edges, variables resolve, and the camera follows the active branch so you never lose the thread.
The timeline replays the run as a waterfall — every branch, every delay, every extraction, laid out on one clock. Open any node for its request, response and assertions.
Gallery
Every frame below is a real capture of the desktop app in dark mode, running against the ShopFlow demo API.
Questions
What the tool is, what it runs, and where the cloud boundary sits — in plain terms.
It means building an API test as a graph instead of a script. Each node is a step — an HTTP request, an assertion, a delay, a merge, or a call to another workflow — and the edges are the order the run follows. You assemble the test on a canvas, then watch it execute node by node.
Yes. Requests run in graph order, so one response can feed the next. A typical workflow logs in, extracts the returned token, and sends it as a bearer header on the following request — no copy-pasting between runs.
Yes. JSONPath extractors pull values out of a response — a token, an ID, a total — and store them as variables that later nodes reference. The variables panel traces each value back to the node that produced it.
No. APIWeave is local-first: you install the desktop app and build, run, and store workflows with no account at all. A Cloud account is optional and adds shared workspaces, member roles, linked devices, and conflict resolution.
Windows, macOS, and Linux. The desktop app ships installers for all three and runs without a Cloud account.
OpenAPI 3.x and Swagger 2.0 definitions import as ready-to-run request nodes, HAR files replay a recorded browser session, and you can paste a cURL command straight onto the canvas.
Execution is always local: the desktop app sends requests and evaluates assertions on your machine, using your network and your environments. Cloud sync is optional and structural — it carries workflow, environment, and secret-reference structure between your machines so a team shares the same definitions. A run never touches Cloud; a sync never runs anything.
No. Workflows are authored and executed by the APIWeave desktop app, against the environments on your own machine. Cloud never builds, runs, or hosts workflow execution, and it stores no run history and no response payloads.
Structure only: workspace, project, and workflow structure, environment names and secret references, plus membership, roles, and revisions. Response bodies, run history, and the requests you send to your systems under test never leave your machine.
Not to APIWeave Cloud. Cloud carries secret references such as {{secrets.apiToken}}, never the values behind them, and the API rejects any sync or conflict payload that carries a non-empty secrets field. When a workflow uses a secret, the value is sent to the API under test as part of that request — from your machine, never through Cloud.
Cloud raises a conflict instead of overwriting either side. You compare the local copy against the cloud copy field by field, choose which copy wins each field, and the resolution lands as a new revision that both desktops then sync.
Yes. The desktop workbench and this cloud control plane are both public on GitHub and free to use. Authentication is OIDC, and access tokens are held server-side rather than in the browser.
The whole control plane is in the repository, and it ships a Docker Compose stack — Postgres, ZITADEL for identity, the Go API, the web app, and a Caddy edge — that brings the full thing up locally. Cloud is under active development and not production-ready, so there is no supported hosting guide yet.
Install the app, open the canvas, and watch your first API test workflow go green. No account, no configuration, no telemetry.
MIT · local-first · Windows, macOS, Linux
Not sure which build you need? The download page lists the artifact for each platform and the one caveat that applies to it.