Design
The most comprehensive OpenAPI implementation in any HTTP client. Your project is the spec: bi-directionally synced, version-fluent (Swagger 2.0, 3.0, 3.1, 3.2), with visual + code editing, Try It Out, full OAuth 2.0 / OIDC, contract validation, and zero vendor lock-in.
Bi-Directional Sync
Edit the YAML, the spec updates the project. Edit the project, the YAML updates. Conflict resolution is built in: source-wins, target-wins, deep-merge, or ask. No drift, ever.
Every Version, Native
Swagger 2.0 imports auto-upgrade to 3.0.3. 3.0 ↔ 3.1 conversion in both directions. 3.2 read & edit. Pure OpenAPI on the way out, so your spec works with any other tool that reads the standard.
Design + Test Together
Designer mode (Design, Split, Preview) and Area mode share state. Edit a path, hit Try It Out, and the request fires from the same workspace. No context switching, no separate tools, no CI/local mismatch.
Visual Designer
Build full OpenAPI specs without writing a single line of YAML. Form-based editors for Info, Servers, Tags, Paths, Parameters, Schemas, Security Schemes, Webhooks, and Callbacks. Every field is guided, there is no syntax to memorize, and the output is never invalid. Collapse sections to focus, expand to compose.
Code Editor + Live Preview
Power-user mode: full code editor with YAML or JSON, real-time validation, error count in toolbar, instant Cmd/Ctrl+S to sync. Split view shows Swagger UI-style preview on the right that updates as you type. Visual Designer and Code Editor edit the same spec, so you can switch any time and both stay in sync.
Area Mode: Test While You Design
Don't leave the designer to test endpoints. Area mode shows your endpoints organized by tag, opens them in tabs, and gives you the full HTTP panel: params, headers, auth, body, assertions, responses. Edit the spec, test the endpoint, repeat. Two contexts, one workspace.
Contract Validation, Built In
Every response is automatically checked against your OpenAPI schema: content type, required fields, types, enums, formats, schema composition. Pass / fail visible in the Contract tab the moment a response lands. Catch breaking changes the second they appear, not after the consumer breaks.
All Four OpenAPI Generations
Whether your spec is 12 years old or shipped last quarter, Atrahasis reads it, edits it, and exports it without rewriting a line by hand.
Conversion that just works
- Swagger 2.0 → 3.0.3 automatic on import: host+basePath+schemes folded into servers, definitions → components/schemas, body params → requestBody, consumes/produces → content negotiation
- 3.0 ↔ 3.1 bidirectional: nullable, exclusiveMinimum/Maximum, examples vs example, type arrays, JSON Schema 2020-12 features
- Toolbar shows the spec version (or Swagger 2.0 → 3.0 if upgraded) so you always know what you're editing
The hard parts, not skipped
- Full JSON Schema 2020-12 in 3.1:
$id,$anchor, type arrays, conditional keywords - $ref resolution across internal, external file, URL, and JSON Pointer paths, circular-reference safe
- All 7 parameter serialization styles (form, simple, spaceDelimited, pipeDelimited, deepObject, matrix, label), plus
explodeandallowReserved - Server variables with defaults & enum, operation-level server overrides
- Webhooks (3.1+) and callbacks (3.0+) with runtime expressions like
$request.body#/id - Discriminator mapping with explicit type → schema lookups, preserved through every import, export, and sync
Project ⟷ Spec, Always in Sync
In every other tool, the spec is an artifact you import and forget. Here, the spec is the project. Four change sources, eight tracked sections, real conflict resolution.
Sections that stay in sync
Each change is captured as a typed entry: section, type (add/update/delete), key, oldValue, newValue, nestedChanges. You see exactly what moved.
Conflict resolution, your call
source-winsEditor changes override (default)target-winsVisual / project changes overridemergeDeep-merge both, reconciling paths and schemas at the property levelaskPrompt you with a side-by-side diff and let you pick
Smart defaults: update beats delete (preserve the item), paths/schemas attempt deep merge, others fall back to source-wins.
Authentication That Actually Authenticates
Four OpenAPI security scheme types, five ways to authenticate. Four OAuth 2.0 flows. PKCE for public clients. OpenID Connect with discovery URL. Token refresh, expiration countdown, per-operation overrides, lock icons that mean something.
in header, query, or cookie. Pick the location, name the field, done.
username + password, Base64-encoded into the Authorization header.
JWTs and access tokens. bearerFormat hint preserved on round-trip.
Authorization Code (with PKCE), Client Credentials, Implicit, Password (ROPC). Browser-based authorize popup, scopes, token + refresh token capture.
Drop in the discovery URL. Atrahasis fetches /.well-known/openid-configuration, lists supported scopes, runs the OAuth2 dance, returns access + ID token.
Valid / Expiring / Expired with a human-readable countdown. Auto-refresh kicks in before the cliff.
Closed (authorized), open (needs auth), or none (security: []). Click to authorize that one endpoint.
Credentials sync between Authorize modal, Area Mode, Try It Out, and Preview. Memory-only, never written to disk.
Try It Out, Done Right
The Preview keeps Swagger UI's interactive feel, with every clever thing you wished Swagger UI did baked in.
Smart Example Generation
Type-aware defaults: date-time → 2024-01-15T10:30:00Z, email → [email protected], uuid → 550e8400-…, enum → first value. Circular references are detected and short-circuited so self-referential schemas don't blow up the form.
Environment Variables in Parameters
Drop {{base_url}}, {{api_token}}, or any var into a parameter value. Resolved against the active environment at send time. The Authorize button and Try It Out share state, so there is no double-entry.
Multi-format Body Editor
JSON in a syntax-highlighted editor with auto-format, urlencoded and form-data as labeled inputs (with required markers), binary upload (image/audio/video/PDF/octet-stream) via native file picker.
atra CLI Export
After any execution, copy the request as a ready-to-run atra command with the URL, every header, and the body already quoted for you. Paste in your terminal, run in CI, share with teammates.
Per-operation Lock Icons
A closed lock means the endpoint is authorized, an open lock means it still needs auth, and a public endpoint (security: []) shows no lock at all. Click the lock to authorize just that operation.
Token Auto-Refresh
OAuth 2.0 / OIDC tokens with a refresh_token are automatically refreshed before they expire. Long sessions stay live without re-authorizing. The status indicator reads Valid, Expiring soon, or Expired, with the time left next to it.
Real Schema Composition
Inheritance, polymorphism, union types. allOf, anyOf, and oneOf are enforced by the runtime contract validator, and all four keywords round-trip through the visual editor untouched.
allOfANDInheritance and traits. Dog extendsAnimal; Pet = Named + Owned + Aged.
oneOfXORPolymorphism. Pet = Cat | Dog | Bird, exactly one shape.
anyOfORUnion of traits. Body matches one or more of the listed shapes, giving you flexible inputs without exploding the schema count.
discriminatorType tagPair with oneOf/anyOf to identify the variant by a property value (petType: cat). Generated examples fill in the matching value, and mapping entries survive every import, export, and sync.
x-atrahasis-* Extensions
Test assertions, per-endpoint auth, environment bindings, all preserved inside your spec as standard x-* extensions. Other tools ignore them. Round-trip safe through every import / export / sync.
| Extension | Where | What it does |
|---|---|---|
| x-atrahasis-project-id | root | Stable project identity across re-imports |
| x-atrahasis-module-id | tag | Module lineage when tags get renamed |
| x-atrahasis-endpoint-id | operation | Endpoint lineage for sync + reports |
| x-atrahasis-assertions | operation | Test assertions live inside the spec |
| x-atrahasis-auth | operation | Per-endpoint auth override |
| x-atrahasis-enabled | parameter | Toggle a param off without deleting it |
| x-atrahasis-env-id | server | Stable environment binding |
| x-atrahasis-env-name | server | Custom display name per environment |
| x-atrahasis-version | root | Atrahasis format version |
x-* extensions from other tools are also preserved. Atrahasis only manages its ownx-atrahasis-* namespace. Nothing of yours gets dropped silently.From Designer to Terminal, Same Spec
Every spec you design is runnable with the atra CLI. Same assertions, same auth, same environments. Your design becomes your test, your monitor, your CI gate.
One spec, every surface
- Try It Out exports any executed request as a ready-to-run
atracommand you can paste in your terminal or drop into CI - Same headers, same auth, same body: what you tested in the designer is what runs from the shell
- Built-in assertions (
-a) gate exit codes, turning any quick request into a smoke test - Exports as YAML or JSON in any supported version, ready to feed into codegen, docs, or governance
- Pure OpenAPI on the way out, no proprietary format trap
# Copy-as-atra from any executed Try It Out
atra -X POST \
'https://api.example.com/users' \
-H 'Authorization: Bearer eyJhbG...' \
-d '{"name":"John"}'
# Re-run the same request with built-in assertions
atra GET https://api.example.com/users/123 \
-a "status eq 200" \
-a "response_time lt 500"
Your Specs, Your Freedom
Industry standards in, industry standards out. Bring your existing OpenAPI file and pick up where the last tool left off, or design from scratch and export anywhere: Stoplight, Postman, codegen, governance, AWS API Gateway, Apigee. We don't hold your work hostage.
Ready to design your API?
Download Atrahasis and ship a spec the rest of your team will actually want to read.