Test your API

Since 0.4.0 Requires Cloak Proxy 0.4.0 or later.

Turn captured traffic into security and correctness checks — the Authorization Matrix, which replays every request as each user to find broken access controls, contract checking, which compares live traffic with your OpenAPI spec, and Release Diff, which compares two builds' traffic.

Cloak Proxy already has the real requests your app makes. This group turns that captured traffic into tests: checks you run against the live server to find bugs that a request you write by hand would never catch, because they only show up with the app’s own tokens, IDs and sequences.

Authorization matrixReplay every captured request as another user, an admin, or no credentials, and see where one user gets another's data back (an IDOR).

Contract checkingCheck every captured request and response against your OpenAPI spec as the app runs: undocumented endpoints and status codes, missing parameters, and bodies that drift from their schemas.

Release diffCompare two recordings of the same journey: endpoints added and removed, fields that changed type, new errors, slower and extra calls, and new third parties receiving user data.

Make tests from trafficTurn captured requests into a test suite: chained IDs and tokens, and tests inferred from the capture, run in the collection runner or CI.

Compare environmentsSend captured requests to staging and production and see which answers differ, or mirror live traffic to a second host.