The API Map

The views, the inspector and playground, audit, coverage, comparing versions, live checks, docs, export, sharing and the AI assistant.

The API Map works on one specification at a time. Everything on this page runs in your browser and needs no account, except the Postman companion. Getting started covers loading a file.

The five views

The tabs across the middle of the screen show the same API five ways:

Getting around the map

• Layout offers Tree, Flowchart, Radial, Mindmap and Force Directed, which is the default.
• Fit puts the whole graph on screen. Clicking the zoom figure resets it to 100%.
• Method chips filter the map to GET, POST and so on. Each chip shows how many endpoints it covers.
• Pan with the arrow keys or by dragging. Zoom with Ctrl and the mouse wheel.
• The gear menu, under Canvas, turns the traffic animation, the minimap and the dot grid on or off. The minimap appears once the graph has eight or more nodes. The traffic animation starts off if your system asks for reduced motion.

On very large APIs the map simplifies itself. Cards are drawn with less detail when you zoom far out, and cards off screen are not drawn at all.

Keyboard shortcuts

The command palette

Press Ctrl+K and type. The palette finds endpoints by name and runs commands. Several tools have no button and are reached only from here: Health monitor, Test flow builder, Mock server, Load tester, Generate docs, Save to collections, API diff, Breaking changes and Copy embed code. If you can't find a feature, open the palette first.

Inspecting an endpoint

Click an operation on the map to open the inspector beside it. Its tabs are:

• Endpoint: method, path, parameters and summary.
• Schema: the request and response shapes.
• Code: the request as cURL, fetch, axios, Python or Go, ready to copy.
• Examples: the example request body, the responses the specification declares, and the last live response you received.
• Related: up to ten operations in the same group or on the same path.
• Scripts: shown only when a Postman collection has pre-request or test scripts. Vizroute shows them but does not run them.

If a request uses a variable such as {{baseUrl}} that has no value, the inspector says so.

Sending a request

Click Try Request in the inspector, or Playground on the top bar, to open the API Playground. It is filled in from the specification. The request tabs are Params, Auth, Headers, Body, Variables and Settings.

• Auth: None, Bearer token, Basic or API key.
• Body: Raw, Form data, URL encoded, GraphQL or Binary.
• Settings: the timeout, 30 seconds by default, and whether to send your browser's cookies.

Press Send or Ctrl+Enter, and the response appears in the same panel. Copy as cURL gives you the same request to run in a terminal.

Your browser sends the request, so the API has to allow cross-origin requests. When a request fails, the playground works out why. It tells you whether nothing is listening at that address, or whether the server refused a request from a browser. In the second case, copy the request as cURL and run it from a terminal.

If the specification gives only a path with no host, the playground asks for a base URL.

Environments

An environment holds variables such as a base URL or a token, so one specification can point at staging or at production. Open Environments from the gear menu to add one and fill in its variables. The active one is named in the status bar. You can also load a Postman environment export on the import screen. Environments are kept in this browser.

Checking the specification

Audit

The Audit tab reads the specification and lists problems. It sends no requests. Each finding is an error, a warning or a note, grouped under Structure, Documentation, Responses, Security and Consistency. The score starts at 100 and drops with each finding. The grade runs from A, at 90 or more, down to F.

Typical findings are an operation with no error response, a verb in a path, an API key sent in the query string, a secret left in an example, an unused schema, or a missing operation ID. Postman collections get their own checks, such as hard-coded tokens and undeclared variables. For a collection, the audit can also offer repairs. Repairs are made to a copy, never to your source.

Coverage

On the Coverage tab, click Choose a file to compare and pick a second document, such as the Postman collection your tests use. The tab then shows which endpoints are covered, which are not, and which requests hit paths the specification does not declare. Copy list copies the result.

Comparing two versions

There are two tools for this, and they answer different questions.

The API diff counts these as changes: a parameter added, removed, retyped, or made required or optional; a request body added, removed or reshaped, down to nested fields; a response status added or removed; response fields added, removed or retyped; deprecation; and a new name or description. Key order and formatting are not changes. For a Postman collection it compares query parameters and the shape of a JSON body. It skips responses, because a collection does not declare them.

Both tools take two specifications, pasted or chosen as files. The Check a change card on the Home page opens Breaking changes directly.

Live checks

These send real requests from your browser to the API, so the same cross-origin limits apply as in the playground. Only point them at a server you are allowed to test.

• Health monitor sends a GET to each endpoint and reports it as up, slow (over 2 seconds), timed out (after 8 seconds) or blocked. It checks the first 25 endpoints by default and asks before sending more than 50. It can refresh itself every 15 seconds, every 30 seconds or once a minute.
• Load tester sends a set number of requests, from 10 to 200, from a set number of simulated users, from 1 to 50, to one endpoint. It sends no body or headers, so use it on simple GET endpoints.
• Test flow builder runs a chain of requests in order. You can take a value from one response, such as data.token, and use it in a later request as {{token}}. Flows are not saved.

Mock server is different: it sends nothing and serves nothing. It makes up example response bodies from the specification's schemas, which you can edit, regenerate and export as mock-server-config.json. It does not give you an address your app could call.

Docs, export and sharing

Documentation

Generate docs, in the command palette, writes reference documentation for the API. Preview it, then download it as Markdown or HTML. The preview is shortened on large APIs, but the download always has everything.

Export

The Export button converts and downloads:

A very large map may be exported as a smaller PNG to stay inside the browser's limits, and the page says when that happens. The SVG always keeps full detail.

Share links and embeds

Share copies a link that opens this map for anyone, with no account. The whole specification is packed into the link, after the #. Browsers never send that part of an address to a server, so the specification is not uploaded and does not end up in anyone's logs. Two things follow from it:

• Anyone who has the link can read the specification. Treat the link the way you would treat the file.
• Large specifications don't fit. If yours is too big, you are offered Download spec so you can send the file instead.

Copy embed code, in the command palette, gives you an iframe that shows a read-only copy of the map on another page, such as a wiki. It carries the specification the same way, with the same size limit. Links made by older versions of Vizroute still open.

The AI assistant

Ask AI, or Ctrl+I, opens "Ask the map". Ask questions about the API, and it can highlight and filter the map for you. In the playground, Explain describes a response.

The assistant needs an OpenRouter API key. Either the site provides one, or you paste your own, which is kept in this browser. When you use it, the loaded specification is sent to OpenRouter. Values that look like credentials are hidden first. Nothing goes to Vizroute itself, which has no server to send it to.

The Postman companion

The Postman button connects to your Postman account. You have to be signed in to Vizroute first, and the button shows a lock until you are.

1. Paste a Postman API key, which starts with PMAK-, and click Connect.
2. Browse your Postman workspaces. Open a collection or an environment to load it here.
3. To send the current specification back, choose Create here or Overwrite. Overwrite replaces the collection in Postman completely.

The key is kept in this browser and sent only to Postman's API. Signing out of Vizroute does not remove it.