API Endpoints
Every route your app actually calls, discovered from real traffic, with types generated from real responses.
"Is there a Swagger for this?"
"There's a Swagger from 2023."
Tree by path prefix, with counts, health dots, and contract tabs.
Point your app at the proxy and the catalogue fills itself in. Routes group by prefix, each showing how many times it's been called, when it was last seen, and whether recent calls were healthy. If a route is in the list, something is really calling it — which is more than most API docs can claim.
In-product visual
Open Contract and you get a TypeScript interface generated from the real bodies FlowMock has seen, with a JSON Schema view alongside. Copy it into your client. When the backend quietly adds a field, it shows up here because it showed up in traffic.
In-product visual
Each route keeps a list of real calls — status, latency, browser, OS, device, how long ago. The 2,835ms outlier next to nine 800ms calls is a conversation you can now have with evidence.
In-product visual
Name a field, choose request body or response body, mark it Stored or Redacted. Redacted fields are dropped at capture time and never written. Set the project default to "store nothing" and opt in the fields you need, or "store everything" and opt out the sensitive ones. Rules apply going forward, and never to mocks you typed yourself.
In-product visual
Common objection
Then start with the project default set to store nothing, and add fields as you need them. FlowMock is a proxy, so nothing has to be stored for it to work — pass-through, mocking, and scenarios all function on redacted traffic. The catalogue and contracts still build; the values just aren't kept.
Free plan, no card, two-minute setup.