Generate API tests from the traffic your app already makes

While you click through a flow, your app fires requests: a POST to /api/orders, a GET that reloads the list, a PATCH when you edit a field. Those requests are your API contract, running live. Most API test tools skip them and make you describe the contract a second time from a spec doc, by hand.

Hover reads the requests off the browser

As you drive the app through the grounded tools, Hover watches the CDP Network events and keeps the xhr and fetch calls. capture_requests hands you what the app actually sent and received: method, URL, status, and response shape. There is no proxy to configure and no MITM certificate to trust. The traffic is already in the browser.

crystallize_api_spec turns a selection of those calls into a *.api-test.spec.ts built on Playwright's request fixture. It runs with no browser open, so it is fast, and it gives you a failure signal your UI specs can't: when the API spec goes red while the UI spec stays green, your contract changed under a page that still happens to render.

Probe access control before you ship it

replay_request re-issues one call so you can test it. Set authenticated: false and Hover sends it from a fresh context with no session, which is how you check that GET /api/orders/42 rejects a request that isn't yours. That is the broken-access-control test every app needs and few have.

Your session stays out of git

The captured request carries your cookie and auth header while you explore. Crystallization drops them from the spec, the same way a credential fill redacts to process.env. You commit a test that asserts the contract, not one that pastes your live session into version control.

One run gives you both layers. Drive checkout once: the UI spec asserts the confirmation screen renders, the API spec asserts POST /api/orders returned 201 with an order id, and the authz check confirms another user can't read that order. One session, three artifacts, all plain Playwright.

Read the API testing docs →