API Explorer & OpenAPI Generator for VS Code — APIScout

Discover REST API endpoints in Express, FastAPI, Django, Flask, and NestJS source code, browse them in an API Explorer sidebar, and export OpenAPI (Swagger) documentation without leaving your editor.

APIScout scans your backend project locally and turns it into a practical API inventory. Nothing is uploaded — discovery runs on the workspace you already have open, so you can scan a branch that has never been deployed. Point it at a codebase whose spec has drifted, or one that never had a spec, and get paths, methods, and their source locations in seconds.

You can browse endpoints in the editor, inspect findings, generate OpenAPI as YAML or JSON, and optionally use bring-your-own AI to enrich endpoint documentation.

The extension also supports an ApyGuard browser handoff through your normal web auth pages. It stores a persistent VS Code integration key, passes that key into the web login flow, and reuses the same key for later ApyGuard integrations.

Demo

What You Can Do

• run ApyGuard APIScout: Run Doctor before the first scan to verify Python, engine resolution, workspace support, and AI readiness
• scan a supported API project and review a built-in summary panel before opening raw JSON on demand
• browse endpoints and findings in the API Explorer sidebar
• filter the API Explorer by method, path text, and finding severity
• sort the API Explorer by path, file, or risk
• review findings collapsed by severity with grouped counts
• view diagnostics for engine-reported inventory issues
• export OpenAPI as .yaml, .yml, or .json
• use CodeLens actions above discovered route handlers
• explain individual endpoints with AI
• merge AI-generated endpoint documentation back into an OpenAPI file

Best For

• teams documenting existing APIs that are ahead of their specs
• engineers validating API inventory before publishing OpenAPI
• security and platform teams mapping exposed routes
• developers working locally who want a source-driven API workflow

Supported Frameworks

• Django
• Express
• FastAPI
• Flask
• NestJS

The engine can also work with existing OpenAPI specification files as input.

Typical Workflow

1. Open a supported API project folder in VS Code.
2. Run ApyGuard APIScout: Run Doctor.
3. Run ApyGuard APIScout: Scan API Project.
4. Review the generated inventory JSON, diagnostics, and API Explorer.
5. Use the API Explorer sidebar actions to filter, sort, re-scan, export, or open settings without leaving the view.
6. Optionally explain a single endpoint and merge the result into an OpenAPI file.

Guided Onboarding

The extension now contributes a built-in walkthrough:

• open Get Started with ApyGuard APIScout from the VS Code Walkthroughs view
• open API Explorer
• run ApyGuard APIScout: Run Doctor
• scan the project
• export OpenAPI after reviewing endpoints and findings

Doctor Checks

ApyGuard APIScout: Run Doctor validates the local-first workflow before scan and export:

• workspace folder availability and supported framework hints
• configured Python runtime reachability
• engine path resolution and CLI boot
• AI configuration readiness, including missing API keys or insecure TLS settings

Commands

• ApyGuard APIScout: Scan API Project
• ApyGuard APIScout: Export OpenAPI
• ApyGuard APIScout: Run Doctor
• ApyGuard APIScout: Explain This API Endpoint
• ApyGuard APIScout: Merge Explained Endpoint Into OpenAPI
• ApyGuard APIScout: Configure AI
• ApyGuard APIScout: Open Settings
• Filter API Explorer
• Sort API Explorer
• Clear API Explorer Filters
• ApyGuard APIScout: Set AI API Key
• ApyGuard APIScout: Sign In
• ApyGuard APIScout: Sign Out
• ApyGuard APIScout: Open Login Screen
• ApyGuard APIScout: Configure Local AI
• ApyGuard APIScout: Clear AI API Key

Requirements

• VS Code 1.90.0 or newer
• Python 3.10 or newer
• a workspace folder open in VS Code

The extension bundles the core-engine source code, but it still needs a working Python interpreter on your machine.

Setup

Recommended in-product setup

For most Marketplace users, the easiest way to get started is from the extension UI:

1. Open the API Explorer sidebar.
2. Use the view actions to scan the project, export OpenAPI, or open the settings screen.
3. Use ApyGuard APIScout: Open Settings to manage AI and batching settings from the built-in settings screen.
4. Return to the sidebar when you want to run the next scan or export.

This is the recommended day-to-day workflow because it keeps setup and execution in one place.

Python

If python3 is already available on your PATH, you can usually start scanning immediately.

If not, set:

{
  "apyguardApiScout.pythonPath": "/absolute/path/to/python"
}

AI

AI-assisted enrichment is optional.

Hosted providers currently supported:

• Gemini
• Together AI
• OpenAI
• Anthropic

Recommended setup path:

1. Open the API Explorer sidebar.
2. Click the settings action or run ApyGuard APIScout: Open Settings.
3. Configure your main AI and batching preferences in the settings screen.
4. Run ApyGuard APIScout: Set AI API Key only when you need to store or update a hosted provider key.

Manual Command Palette path:

1. Run ApyGuard APIScout: Configure AI.
2. Choose a provider and model.
3. Run ApyGuard APIScout: Set AI API Key.

For local AI, the recommended manual path is:

1. Run ApyGuard APIScout: Configure Local AI.
2. Select the protocol adapter your local gateway exposes.
3. Set the base URL for that endpoint.

After that, use ApyGuard APIScout: Open Settings if you want to adjust batching or the rest of the AI-related settings in one place.

Supported local adapters:

• openai
• gemini
• anthropic
• together

API keys are stored securely with the VS Code secrets API.

Hosted providers supported by the extension:

• gemini
• together
• openai
• azure
• anthropic

Key Settings

You can manage these directly in VS Code settings, but Marketplace users will usually have the best experience by opening the built-in settings screen with ApyGuard APIScout: Open Settings.

• apyguardApiScout.pythonPath: Python 3.10+ interpreter used to run the engine
• apyguardApiScout.enginePath: optional absolute override for the engine root
• apyguardApiScout.outputFileName: default export filename
• apyguardApiScout.authEnabled: enables or disables the browser handoff to the ApyGuard web auth flow
• apyguardApiScout.authLoginUrl: browser login URL for ApyGuard web auth
• apyguardApiScout.aiEnabled: enables or disables AI-assisted scan and export enrichment
• apyguardApiScout.aiProvider: provider selection
• apyguardApiScout.aiBaseUrl: custom provider or local gateway URL
• apyguardApiScout.aiLocalAdapter: local protocol adapter
• apyguardApiScout.aiModel: model name override
• apyguardApiScout.aiCaBundlePath: CA bundle path for AI HTTPS requests
• apyguardApiScout.aiAllowInsecureTls: disables TLS verification for local testing and defaults to false
• apyguardApiScout.aiDebugEnabled: writes AI debug logs
• apyguardApiScout.aiDebugLogDir: workspace-relative AI debug log directory
• apyguardApiScout.aiBatchSize: endpoints per AI inspection batch
• apyguardApiScout.aiMaxConcurrentFlows: maximum parallel AI inspection flows

Example:

{
  "apyguardApiScout.pythonPath": "/absolute/path/to/.venv/bin/python",
  "apyguardApiScout.outputFileName": "openapi.generated.yaml",
  "apyguardApiScout.aiEnabled": true,
  "apyguardApiScout.aiProvider": "azure",
  "apyguardApiScout.aiBaseUrl": "https://your-resource.services.ai.azure.com/openai/v1",
  "apyguardApiScout.aiModel": "your-deployment-name"
}

Azure base URL notes:

• Legacy Azure OpenAI: https://your-resource.openai.azure.com
• OpenAI v1 on Azure or Foundry: https://your-resource.openai.azure.com/openai/v1 or https://your-resource.services.ai.azure.com/openai/v1
• Foundry Models API: https://your-resource.services.ai.azure.com/models

Explorer Filtering and Prioritization

After a scan, API Explorer can be tuned for large inventories:

• method filter for endpoints and method-aware findings
• path text filter shared across endpoints and findings
• finding severity filter for high, medium, or low sensitivity issues
• severity sub-groups with counts like High (2) and Medium (3)
• sort modes for path, file, or risk

Local-First Behavior

APIScout runs analysis locally inside your VS Code environment.

That means:

• source code is scanned from your current workspace
• the Python engine runs on your machine
• you can disable AI and use engine-only workflows
• local development builds can point to a sibling ../core-engine

Troubleshooting

Python executable not found

The engine requires Python 3.10 or later. Set apyguardApiScout.pythonPath to a valid Python 3.10+ interpreter path.

Engine not found

If you are running from source and the extension cannot resolve the engine automatically, set:

{
  "apyguardApiScout.enginePath": "/absolute/path/to/core-engine"
}

Empty scan results

Common causes:

• the workspace is not a supported framework
• routes are declared dynamically
• the wrong folder is open

Run ApyGuard APIScout: Scan API Project first and inspect the raw inventory output before exporting.