Breaking-change detection for third-party APIsThird-party APIs change.
Know before your users do.
APIDiffGuard checks the live responses of the APIs you call and flags breaking field changes, even behind a 200 OK.
Free for 3 endpoints · no credit card · MIT open source. Behind a VPN? Self-host it.
fig. 1 — a scheduled check catching a vendor change
− removed~ changed+ added
GET api.pipelinecrm.example/v2/contacts/8812
2 breaking changes against baseline v12
Slack · #integrations
Breaking drift on /v2/contacts/8812: a field was removed, another is now null.
Your uptime monitor says 200 OK. The response is missing a field your code reads. Uptime checks that an API answered. APIDiffGuard checks what it said.
FIG 0.1
Baselines, versioned
A known-good response per endpoint, with headers and status. Restore one, or compare any two versions.
FIG 0.2
A diff that grades itself
Removed fields, type flips and new nulls are breaking. Schema mode ignores value churn, so a changed timestamp is never drift.
FIG 0.3
Alerts that don't cry wolf
A severity threshold per channel, and repeats of the same break held back until something new changes.
Five minutes to your first check.
Run it from your terminal, gate a pull request, call it from your own code, or hand the setup to your coding agent. No account needed for the free JSON Diff or the CLI.
# diff a live endpoint against a saved baseline
npx @apidiffguard/cli check \
--baseline ./fixtures/contacts.json \
--url "$CRM_API/v2/contacts/8812" \
--header "Authorization: Bearer $CRM_TOKEN" \
--schema-only --fail-on breakingWhat counts as breaking
| − field removed | breaking |
|---|---|
| ~ type changed | breaking |
| ~ value became null | breaking |
| ~ status class changed (2xx → 4xx) | breaking |
| ~ header changed | warning |
| + field added | info |
What we store, and how
Built for APIs with credentials.
- Endpoint credentials sealed with AES-256-GCM. Replaceable, never readable back, not even by owners.
- Outbound requests refuse private and loopback addresses, and credentials drop when a redirect changes origin.
- Bodies capped at 2 MB, old responses trimmed on a schedule.
Shipping in the open.
Full changelog →Unreleased
Endpoints can be created through the REST API
Unreleased
A self-hosting guide
Unreleased
Workspaces can be deleted from the UI
Unreleased
Yearly billing
Cloud
We run it. You get the alerts.
Schedules, retries, alert delivery, workspaces and roles. Reaches public endpoints.
Self-host
Every line is MIT.
Run the whole app inside your network to watch APIs behind a VPN. Same features.
Start with the three that scare you.
Free for 3 endpoints, forever. Yearly billing gets two months free. View pricing
Free
$0
3 endpoints250 checks / mo1 seat, manual checks
Starter
$19 /mo
20 endpoints5,000 checks / mo3 seats, schedules
Pro
$49 /mo
100 endpoints25,000 checks / mo10 seats, schedules
Team
Custom
Custom limitsArranged directly
Questions, answered.
What is APIDiffGuard?
APIDiffGuard is an open-source (MIT) tool that monitors the live responses of the APIs you depend on. It compares each response to a saved baseline and flags breaking changes such as removed fields, type changes, values that became null, and status-class flips. It runs as a hosted cloud service, a self-hosted app, or a CLI in CI.
How is this different from uptime monitoring?
Uptime monitors check that an API answered, usually by status code and latency. APIDiffGuard checks what it answered: it diffs the body, status and headers against a baseline, so a 200 OK with a renamed or missing field is reported as a breaking change instead of a green check.
How is APIDiffGuard different from oasdiff and other OpenAPI diff tools?
OpenAPI diff tools such as oasdiff compare two spec files, so they only help when a provider publishes an accurate spec. APIDiffGuard compares the responses an API actually returns, which catches drift in vendors with no spec, or a spec that no longer matches production. OpenAPI import is still there to register endpoints in bulk.
How do you detect breaking API changes in CI?
Save a known-good response as a baseline file, then run npx @apidiffguard/cli check --baseline <file> --url <endpoint> --schema-only --fail-on breaking in your pipeline. The command exits non-zero when a breaking change is found, which fails the job. It works in GitHub Actions or any CI that runs Node.
What is schema drift in APIs?
Schema drift is when a live API response changes shape over time — fields disappear, types change, values become null, or status classes flip — without your client code being ready. It usually ships without a version bump, which is why it reaches production unnoticed.
Will timestamps and request IDs trigger alerts?
No. Schema mode ignores leaf value changes, and fields such as request_id, timestamp, created_at, updated_at and etag are ignored by default. Ignore rules on each endpoint cover anything else that changes on every call.
Can I self-host APIDiffGuard?
Yes. Every line is MIT-licensed. Self-hosting is the way to monitor APIs behind a VPN, because APIDiffGuard Cloud only reaches public endpoints. The self-hosting guide covers the database, environment variables, the encryption key and the two scheduled workers.
Put a guard dog on
your integrations.
Add your riskiest vendor endpoint. The first check runs in seconds.