ApyGuard APIScout

Discover API endpoints from source code, review the results inside VS Code, and export OpenAPI without leaving your editor.

ApyGuard APIScout uses a local Python engine to scan supported backend projects and turn them into a practical API inventory. You can browse endpoints in the editor, inspect findings, generate OpenAPI, and optionally use bring-your-own AI to enrich endpoint documentation.

The extension also supports an ApyGuard browser handoff through your normal web auth pages. It stores a persistent VS Code integration key, passes that key into the web login flow, and reuses the same key for later ApyGuard integrations.

Demo

What You Can Do

• run ApyGuard APIScout: Run Doctor before the first scan to verify Python, engine resolution, workspace support, and AI readiness
• scan a supported API project and review a built-in summary panel before opening raw JSON on demand
• browse endpoints and findings in the API Explorer sidebar
• filter the API Explorer by method, path text, and finding severity
• sort the API Explorer by path, file, or risk
• review findings collapsed by severity with grouped counts
• view diagnostics for engine-reported inventory issues
• export OpenAPI as .yaml, .yml, or .json
• use CodeLens actions above discovered route handlers
• explain individual endpoints with AI
• merge AI-generated endpoint documentation back into an OpenAPI file

Best For

• teams documenting existing APIs that are ahead of their specs
• engineers validating API inventory before publishing OpenAPI
• security and platform teams mapping exposed routes
• developers working locally who want a source-driven API workflow

Supported Frameworks

• Django
• Express
• FastAPI
• Flask
• NestJS

The engine can also work with existing OpenAPI specification files as input.

Typical Workflow

1. Open a supported API project folder in VS Code.
2. Run ApyGuard APIScout: Run Doctor.
3. Run ApyGuard APIScout: Scan API Project.
4. Review the generated inventory JSON, diagnostics, and API Explorer.
5. Use the API Explorer sidebar actions to filter, sort, re-scan, export, or open settings without leaving the view.
6. Optionally explain a single endpoint and merge the result into an OpenAPI file.

Guided Onboarding

The extension now contributes a built-in walkthrough:

• open Get Started with ApyGuard APIScout from the VS Code Walkthroughs view
• open API Explorer
• run ApyGuard APIScout: Run Doctor
• scan the project
• export OpenAPI after reviewing endpoints and findings

Doctor Checks

ApyGuard APIScout: Run Doctor validates the local-first workflow before scan and export:

• workspace folder availability and supported framework hints
• configured Python runtime reachability
• engine path resolution and CLI boot
• AI configuration readiness, including missing API keys or insecure TLS settings

Commands

• ApyGuard APIScout: Scan API Project
• ApyGuard APIScout: Export OpenAPI
• ApyGuard APIScout: Run Doctor
• ApyGuard APIScout: Explain This API Endpoint
• ApyGuard APIScout: Merge Explained Endpoint Into OpenAPI
• ApyGuard APIScout: Configure AI
• ApyGuard APIScout: Open Settings
• Filter API Explorer
• Sort API Explorer
• Clear API Explorer Filters
• ApyGuard APIScout: Set AI API Key
• ApyGuard APIScout: Sign In
• ApyGuard APIScout: Sign Out
• ApyGuard APIScout: Open Login Screen
• ApyGuard APIScout: Configure Local AI
• ApyGuard APIScout: Clear AI API Key

Requirements

• VS Code 1.90.0 or newer
• Python 3.10 or newer
• a workspace folder open in VS Code

The extension bundles the core-engine source code, but it still needs a working Python interpreter on your machine.

Setup

Recommended in-product setup

For most Marketplace users, the easiest way to get started is from the extension UI:

1. Open the API Explorer sidebar.
2. Use the view actions to scan the project, export OpenAPI, or open the settings screen.
3. Use ApyGuard APIScout: Open Settings to manage AI and batching settings from the built-in settings screen.
4. Return to the sidebar when you want to run the next scan or export.

This is the recommended day-to-day workflow because it keeps setup and execution in one place.

Python

If python3 is already available on your PATH, you can usually start scanning immediately.

If not, set:

{
  "apyguardApiScout.pythonPath": "/absolute/path/to/python"
}

AI

AI-assisted enrichment is optional.

Hosted providers currently supported:

• Gemini
• Together AI
• OpenAI
• Anthropic

Recommended setup path:

1. Open the API Explorer sidebar.
2. Click the settings action or run ApyGuard APIScout: Open Settings.
3. Configure your main AI and batching preferences in the settings screen.
4. Run ApyGuard APIScout: Set AI API Key only when you need to store or update a hosted provider key.

Manual Command Palette path:

1. Run ApyGuard APIScout: Configure AI.
2. Choose a provider and model.
3. Run ApyGuard APIScout: Set AI API Key.

For local AI, the recommended manual path is:

1. Run ApyGuard APIScout: Configure Local AI.
2. Select the protocol adapter your local gateway exposes.
3. Set the base URL for that endpoint.

After that, use ApyGuard APIScout: Open Settings if you want to adjust batching or the rest of the AI-related settings in one place.

Supported local adapters:

• openai
• gemini
• anthropic
• together

API keys are stored securely with the VS Code secrets API.

Hosted providers supported by the extension:

• gemini
• together
• openai
• azure
• anthropic

Key Settings

You can manage these directly in VS Code settings, but Marketplace users will usually have the best experience by opening the built-in settings screen with ApyGuard APIScout: Open Settings.

• apyguardApiScout.pythonPath: Python 3.10+ interpreter used to run the engine
• apyguardApiScout.enginePath: optional absolute override for the engine root
• apyguardApiScout.outputFileName: default export filename
• apyguardApiScout.authEnabled: enables or disables the browser handoff to the ApyGuard web auth flow
• apyguardApiScout.authLoginUrl: browser login URL for ApyGuard web auth
• apyguardApiScout.aiEnabled: enables or disables AI-assisted scan and export enrichment
• apyguardApiScout.aiProvider: provider selection
• apyguardApiScout.aiBaseUrl: custom provider or local gateway URL
• apyguardApiScout.aiLocalAdapter: local protocol adapter
• apyguardApiScout.aiModel: model name override
• apyguardApiScout.aiCaBundlePath: CA bundle path for AI HTTPS requests
• apyguardApiScout.aiAllowInsecureTls: disables TLS verification for local testing and defaults to false
• apyguardApiScout.aiDebugEnabled: writes AI debug logs
• apyguardApiScout.aiDebugLogDir: workspace-relative AI debug log directory
• apyguardApiScout.aiBatchSize: endpoints per AI inspection batch
• apyguardApiScout.aiMaxConcurrentFlows: maximum parallel AI inspection flows

Example:

{
  "apyguardApiScout.pythonPath": "/absolute/path/to/.venv/bin/python",
  "apyguardApiScout.outputFileName": "openapi.generated.yaml",
  "apyguardApiScout.aiEnabled": true,
  "apyguardApiScout.aiProvider": "azure",
  "apyguardApiScout.aiBaseUrl": "https://your-resource.services.ai.azure.com/openai/v1",
  "apyguardApiScout.aiModel": "your-deployment-name"
}

Azure base URL notes:

• Legacy Azure OpenAI: https://your-resource.openai.azure.com
• OpenAI v1 on Azure or Foundry: https://your-resource.openai.azure.com/openai/v1 or https://your-resource.services.ai.azure.com/openai/v1
• Foundry Models API: https://your-resource.services.ai.azure.com/models

Explorer Filtering and Prioritization

After a scan, API Explorer can be tuned for large inventories:

• method filter for endpoints and method-aware findings
• path text filter shared across endpoints and findings
• finding severity filter for high, medium, or low sensitivity issues
• severity sub-groups with counts like High (2) and Medium (3)
• sort modes for path, file, or risk

Local-First Behavior

APIScout runs analysis locally inside your VS Code environment.

That means:

• source code is scanned from your current workspace
• the Python engine runs on your machine
• you can disable AI and use engine-only workflows
• local development builds can point to a sibling ../core-engine

Troubleshooting

Python executable not found

The engine requires Python 3.10 or later. Set apyguardApiScout.pythonPath to a valid Python 3.10+ interpreter path.

Engine not found

If you are running from source and the extension cannot resolve the engine automatically, set:

{
  "apyguardApiScout.enginePath": "/absolute/path/to/core-engine"
}

Empty scan results

Common causes:

• the workspace is not a supported framework
• routes are declared dynamically
• the wrong folder is open

Run ApyGuard APIScout: Scan API Project first and inspect the raw inventory output before exporting.