APIClarity website screenshot

APIClarity

APIClarity is an open source (Apache-2.0) API security and observability tool that captures API traffic in a Kubernetes environment, reconstructs OpenAPI specifications from what it observes, and detects shadow APIs, zombie APIs, specification drift and broken function-level authorization. It integrates with Istio, Kong, Tyk, Kuma, a tap DaemonSet and an OpenTelemetry Collector as traffic sources, and ships as a Helm chart you deploy into your own cluster — there is no hosted service, no vendor account and no vendor API host. It was part of the OpenClarity project. APIClarity has reached end of life: the source repository was archived read-only by its owner on 2026-05-29, the last release was v0.14.5 on 2023-05-05, and both project websites (openclarity.io and apiclarity.io) now return HTTP 404. The source, the eleven published specifications, the Helm chart repository and the container images all remain publicly readable, which is what this profile is built from.

APIClarity publishes 11 APIs on the APIs.io network, including API Events API, API Inventory API, Control API, and 8 more. Tagged areas include API Observability, API Security, API Traffic Analysis, Cisco, and Kubernetes.

The APIClarity catalog on APIs.io includes 1 event-driven AsyncAPI specification.

APIClarity’s developer surface includes changelog, sandbox, getting-started guide, API reference, support, authentication, documentation, and 22 more developer resources.

35.3/100 thin ▬ flat Agent 33/100 agent ready Full breakdown ↓
scored 2026-09-08 · rubric v0.20.0
AccessFreemiumSelf serve⚡ Free to try
5 APIs 7 Features 5 Use Cases
API ObservabilityAPI SecurityAPI Traffic AnalysisCiscoKubernetesOpen-SourceOpenAPI ReconstructionOpenClarityService MeshShadow APIs

Kin Score

Kin Score Kin Score How this is scored →
scored 2026-09-08 · rubric v0.20.0
Create-or-Update Ergonomics applies to this provider. This API accepts writes, so it carries 10 points of the composite. It is scored from the published contracts themselves: whether a caller can create-or-update in one call, whether the write accepts a key the caller already holds, and whether the response says which branch ran. Without that, every write needs a search-and-branch in front of it, and the first time that check is skipped a duplicate record is created. Scored against the observed mean rather than raw — a provider at the catalog average is unchanged by this facet, not penalised by it.
Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. Every facet and dimension name above is a link: it opens that measurement's own page — what it means, the exact checks that feed it, how the whole catalog distributes on it, and the providers at the top of it. This rating is computed from github.com/api-evangelist/apiclarity: open an issue to ask a question, or submit a pull request to add artifacts. Submit an artifact on GitHub — free → Manage your own listing — the Influence plan, $499/mo →

APIs 11

Individual APIs this provider publishes, each with its own machine-readable definition.

APIClarity API Events API

Captured API traffic events.

APIClarity API Inventory API

Discovered APIs and their reconstructed specifications.

APIClarity Control API

Control-plane endpoints for trace sources and discovered APIs.

APIClarity Features API

Enabled features in the deployment.

APIClarity BFLA Module API

Broken Function Level Authorization detection. Learns an authorization model from observed API interactions — which callers are supposed to invoke which operations — then flags ...

APIClarity Fuzzer Module API

Active security testing. Drives generated traffic at an API based on its specification to find implementation flaws, then returns a severity-ranked report and a specification an...

APIClarity Trace Analyzer Module API

Analyzes the path, headers and body of observed requests and responses for weak authentication, exposure of sensitive information and potential broken object level authorization...

APIClarity Spec Differ Module API

Compares observed API traces against the provided or reconstructed specification to surface shadow APIs (observed but undocumented), zombie APIs (observed but marked deprecated)...

APIClarity Spec Reconstructor Module API

Controls reconstruction of an OpenAPI specification from live traffic for a discovered API. Served under /api/modules/specreconstructor.

APIClarity Plugins Telemetry API

The Swagger 2.0 contract every APIClarity traffic-source plugin implements to push captured traffic into a deployment — POST /telemetry, GET /hostsToTrace and POST /control/newD...

APIClarity Notifications API

An inverted contract — the endpoint a registered listener must implement, which APIClarity POSTs to. Six notification types share one polymorphic envelope discriminated on notif...

Scroll for all 11

Open Collections 6

Open, tool-agnostic API collections (OpenAPI-derived and Bruno).

API Collection

OPEN COLLECTION

APIClarity API Events API

OPEN COLLECTION

APIClarity API

OPEN COLLECTION

Pricing Plans 1

Published pricing tiers and plan structures.

Rate Limits 1

Documented rate limits and quota policies.

Apiclarity Rate Limits

0 limits

RATE LIMITS

FinOps 1

Cost, billing, and metering signals for API financial operations.

Features 7

Notable capabilities this provider offers.

OpenAPI Spec Reconstruction

Automatically reconstruct OpenAPI specifications from observed live API traffic without code instrumentation.

Shadow API Detection

Identify undocumented shadow APIs being called in production that are not reflected in official specifications.

Zombie API Detection

Detect deprecated or decommissioned API endpoints still receiving traffic in production.

API Diff Analysis

Compare observed API behavior against documented specifications to identify drifts, changes, and violations.

API Security Alerts

Generate security findings and alerts based on API traffic analysis and specification violations.

Kubernetes Integration

Deploy as a sidecar or via Helm charts for integration with Kubernetes service meshes and API gateways.

API Inventory

Automatically build and maintain an inventory of all APIs discovered in the environment.

Scroll for all 7

Event Specifications 1

AsyncAPI definitions for this provider's event-driven and streaming APIs.

Security Posture 2

Authentication, domain security, vulnerability disclosure, and trust-center signals.

Apiclarity Authentication

apiKey · 1 scheme

SECURITY

Apiclarity Domain Security

no transport/DNS hardening detected

SECURITY

Agentic Access 1

Recommended x-agentic-access execution contracts for AI agents.

Apiclarity Agentic Access

27 operations · 8 acting · 3 human-in-the-loop

27 operations · 8 acting

AGENTIC

Use Cases 5

What developers build with this provider.

API Discovery

Discover all APIs running in a Kubernetes environment including undocumented and shadow APIs.

API Security Posture Assessment

Assess API security by detecting shadow APIs, spec violations, and suspicious traffic patterns.

API Specification Generation

Generate OpenAPI specifications from live traffic for APIs that lack formal documentation.

API Governance

Enforce API consistency by detecting deviations between actual API behavior and official specifications.

Incident Response

Investigate API security incidents using traffic analysis, API inventory, and spec diff data.

Resources

Get Started 2

Portal, sign-up, and the first successful call

Documentation 2

Reference material describing how the API behaves

Agent Surfaces 4

MCP servers, agent skills, and machine-readable catalogs

Design & Contract 6

Pagination, idempotency, versioning, errors, and events

Build 4

SDKs, sample code, and the tooling you integrate with

Access & Security 2

Authentication, authorization, and security posture

Operate 6

Status, limits, changes, and where to get help

Commercial 2

Pricing, plans, and the legal terms of use

Company 1

The organization behind the API

Source (apis.yml)

apis.yml Raw ↑
aid: apiclarity
name: APIClarity
description: 'APIClarity is an open source (Apache-2.0) API security and observability tool that captures API traffic in a
  Kubernetes environment, reconstructs OpenAPI specifications from what it observes, and detects shadow APIs, zombie APIs,
  specification drift and broken function-level authorization. It integrates with Istio, Kong, Tyk, Kuma, a tap DaemonSet
  and an OpenTelemetry Collector as traffic sources, and ships as a Helm chart you deploy into your own cluster — there is
  no hosted service, no vendor account and no vendor API host. It was part of the OpenClarity project. APIClarity has reached
  end of life: the source repository was archived read-only by its owner on 2026-05-29, the last release was v0.14.5 on 2023-05-05,
  and both project websites (openclarity.io and apiclarity.io) now return HTTP 404. The source, the eleven published specifications,
  the Helm chart repository and the container images all remain publicly readable, which is what this profile is built from.'
type: Index
deliveryModel:
  model: unknown
  open_source: unknown
  commercial: false
  callable_host: false
  label: Delivery model not determined — needs a product licence on record
  confidence: low
  source:
  - openapi
  - repository-unlicensed
  generated: '2026-08-28'
  method: derived
accessModel:
  pricing: freemium
  onboarding: self-serve
  trial: false
  try_now: true
  public: false
  label: Freemium · Self-serve signup
  confidence: medium
  source:
  - plans
  - authentication
  - security
  generated: '2026-09-03'
  method: derived
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/apiclarity.png
tags:
- API Observability
- API Security
- API Traffic Analysis
- Cisco
- Kubernetes
- Open-Source
- OpenAPI Reconstruction
- OpenClarity
- Service Mesh
- Shadow APIs
tags_raw:
- API Observability
- API Security
- API Traffic Analysis
- Cisco
- Kubernetes
- Open Source
- OpenAPI Reconstruction
- OpenClarity
- Service Mesh
- Shadow APIs
url: https://raw.githubusercontent.com/api-evangelist/apiclarity/refs/heads/main/apis.yml
created: '2026-03-26'
modified: '2026-09-04'
specificationVersion: '0.23'
x-enrichment:
  date: '2026-09-04'
  status: enriched
  artifacts_added: 39
  pass: local-v3
apis:
- aid: apiclarity:apiclarity-api-events-api
  name: APIClarity API Events API
  description: Captured API traffic events.
  humanURL: https://github.com/openclarity/apiclarity
  baseURL: https://apiclarity-server/api
  tags:
  - API Events
  properties:
  - type: OpenAPI
    url: openapi/apiclarity-api-events-api-openapi.yml
  - type: Overlay
    url: overlays/apiclarity-api-events-api-overlay.yaml
  - type: Documentation
    url: https://github.com/openclarity/apiclarity#readme
  - type: GettingStarted
    url: https://github.com/openclarity/apiclarity#getting-started
  - type: GitHubRepository
    url: https://github.com/openclarity/apiclarity
- aid: apiclarity:apiclarity-api-inventory-api
  name: APIClarity API Inventory API
  description: Discovered APIs and their reconstructed specifications.
  humanURL: https://github.com/openclarity/apiclarity
  baseURL: https://apiclarity-server/api
  tags:
  - API Inventory
  properties:
  - type: OpenAPI
    url: openapi/apiclarity-api-inventory-api-openapi.yml
  - type: Overlay
    url: overlays/apiclarity-api-inventory-api-overlay.yaml
  - type: Documentation
    url: https://github.com/openclarity/apiclarity#readme
  - type: GettingStarted
    url: https://github.com/openclarity/apiclarity#getting-started
  - type: GitHubRepository
    url: https://github.com/openclarity/apiclarity
- aid: apiclarity:apiclarity-control-api
  name: APIClarity Control API
  description: Control-plane endpoints for trace sources and discovered APIs.
  humanURL: https://github.com/openclarity/apiclarity
  baseURL: https://apiclarity-server/api
  tags:
  - Control
  properties:
  - type: OpenAPI
    url: openapi/apiclarity-control-api-openapi.yml
  - type: Overlay
    url: overlays/apiclarity-control-api-overlay.yaml
  - type: Documentation
    url: https://github.com/openclarity/apiclarity#readme
  - type: GettingStarted
    url: https://github.com/openclarity/apiclarity#getting-started
  - type: GitHubRepository
    url: https://github.com/openclarity/apiclarity
- aid: apiclarity:apiclarity-features-api
  name: APIClarity Features API
  description: Enabled features in the deployment.
  humanURL: https://github.com/openclarity/apiclarity
  baseURL: https://apiclarity-server/api
  tags:
  - Features
  properties:
  - type: OpenAPI
    url: openapi/apiclarity-features-api-openapi.yml
  - type: Overlay
    url: overlays/apiclarity-features-api-overlay.yaml
  - type: Documentation
    url: https://github.com/openclarity/apiclarity#readme
  - type: GettingStarted
    url: https://github.com/openclarity/apiclarity#getting-started
  - type: GitHubRepository
    url: https://github.com/openclarity/apiclarity
- aid: apiclarity:apiclarity-bfla-module-api
  name: APIClarity BFLA Module API
  description: Broken Function Level Authorization detection. Learns an authorization model from observed API interactions
    — which callers are supposed to invoke which operations — then flags violations against it. Served under /api/modules/bfla
    in an APIClarity deployment.
  humanURL: https://github.com/openclarity/apiclarity/tree/master/backend/pkg/modules/internal/bfla
  baseURL: https://apiclarity-server/api/modules/bfla
  tags:
  - BFLA
  - Authorization
  - API Security
  properties:
  - type: OpenAPI
    url: openapi/apiclarity-bfla-module-openapi.yml
  - type: Overlay
    url: overlays/apiclarity-bfla-module-overlay.yaml
  - type: Documentation
    url: https://github.com/openclarity/apiclarity/blob/master/backend/pkg/modules/internal/bfla/README.md
  - type: GitHubRepository
    url: https://github.com/openclarity/apiclarity
- aid: apiclarity:apiclarity-fuzzer-module-api
  name: APIClarity Fuzzer Module API
  description: Active security testing. Drives generated traffic at an API based on its specification to find implementation
    flaws, then returns a severity-ranked report and a specification annotated with the findings. Served under /api/modules/fuzzer.
  humanURL: https://github.com/openclarity/apiclarity/tree/master/backend/pkg/modules/internal/fuzzer
  baseURL: https://apiclarity-server/api/modules/fuzzer
  tags:
  - Fuzzing
  - Security Testing
  - API Security
  properties:
  - type: OpenAPI
    url: openapi/apiclarity-fuzzer-module-openapi.yml
  - type: Overlay
    url: overlays/apiclarity-fuzzer-module-overlay.yaml
  - type: AgentSkill
    url: skills/apiclarity-run-a-fuzz-test.md
  - type: GitHubRepository
    url: https://github.com/openclarity/apiclarity
- aid: apiclarity:apiclarity-trace-analyzer-module-api
  name: APIClarity Trace Analyzer Module API
  description: Analyzes the path, headers and body of observed requests and responses for weak authentication, exposure of
    sensitive information and potential broken object level authorization. Served under /api/modules/traceanalyzer.
  humanURL: https://github.com/openclarity/apiclarity/tree/master/backend/pkg/modules/internal/traceanalyzer
  baseURL: https://apiclarity-server/api/modules/traceanalyzer
  tags:
  - Trace Analysis
  - API Security
  properties:
  - type: OpenAPI
    url: openapi/apiclarity-trace-analyzer-module-openapi.yml
  - type: Overlay
    url: overlays/apiclarity-trace-analyzer-module-overlay.yaml
  - type: Documentation
    url: https://github.com/openclarity/apiclarity/blob/master/backend/pkg/modules/internal/traceanalyzer/README.md
  - type: GitHubRepository
    url: https://github.com/openclarity/apiclarity
- aid: apiclarity:apiclarity-spec-differ-module-api
  name: APIClarity Spec Differ Module API
  description: Compares observed API traces against the provided or reconstructed specification to surface shadow APIs (observed
    but undocumented), zombie APIs (observed but marked deprecated) and drift. Served under /api/modules/spec_differ.
  humanURL: https://github.com/openclarity/apiclarity/tree/master/backend/pkg/modules/internal/spec_differ
  baseURL: https://apiclarity-server/api/modules/spec_differ
  tags:
  - Spec Diff
  - Shadow APIs
  - API Governance
  properties:
  - type: OpenAPI
    url: openapi/apiclarity-spec-differ-module-openapi.yml
  - type: Overlay
    url: overlays/apiclarity-spec-differ-module-overlay.yaml
  - type: AgentSkill
    url: skills/apiclarity-hunt-shadow-and-zombie-apis.md
  - type: GitHubRepository
    url: https://github.com/openclarity/apiclarity
- aid: apiclarity:apiclarity-spec-reconstructor-module-api
  name: APIClarity Spec Reconstructor Module API
  description: Controls reconstruction of an OpenAPI specification from live traffic for a discovered API. Served under /api/modules/specreconstructor.
  humanURL: https://github.com/openclarity/apiclarity/tree/master/backend/pkg/modules/internal/specreconstructor
  baseURL: https://apiclarity-server/api/modules/specreconstructor
  tags:
  - OpenAPI Reconstruction
  - API Discovery
  properties:
  - type: OpenAPI
    url: openapi/apiclarity-spec-reconstructor-module-openapi.yml
  - type: Overlay
    url: overlays/apiclarity-spec-reconstructor-module-overlay.yaml
  - type: AgentSkill
    url: skills/apiclarity-reconstruct-and-approve-a-spec.md
  - type: GitHubRepository
    url: https://github.com/openclarity/apiclarity
- aid: apiclarity:apiclarity-plugins-telemetry-api
  name: APIClarity Plugins Telemetry API
  description: The Swagger 2.0 contract every APIClarity traffic-source plugin implements to push captured traffic into a
    deployment — POST /telemetry, GET /hostsToTrace and POST /control/newDiscoveredAPIs. Authenticated with the optional X-Trace-Source-Token
    header issued when a trace source is registered. Implemented by the Istio WASM filter, the tap DaemonSet, and the Kong,
    Tyk, Kuma and OpenTelemetry Collector plugins.
  humanURL: https://github.com/openclarity/apiclarity/tree/master/plugins/api
  baseURL: https://apiclarity-server/api
  tags:
  - Telemetry
  - Traffic Capture
  - Plugins
  properties:
  - type: OpenAPI
    url: openapi/apiclarity-plugins-telemetry-swagger.yml
  - type: Overlay
    url: overlays/apiclarity-plugins-telemetry-swagger-overlay.yaml
  - type: Authentication
    url: authentication/apiclarity-authentication.yml
  - type: Documentation
    url: https://github.com/openclarity/apiclarity/tree/master/plugins
  - type: GitHubRepository
    url: https://github.com/openclarity/apiclarity
- aid: apiclarity:apiclarity-notifications-api
  name: APIClarity Notifications API
  description: 'An inverted contract — the endpoint a registered listener must implement, which APIClarity POSTs to. Six notification
    types share one polymorphic envelope discriminated on notificationType: NewDiscoveredAPINotification, SpecDiffsNotification,
    ApiFindingsNotification, AuthorizationModelNotification, TestProgressNotification and TestReportNotification. This is
    APIClarity''s webhook surface; no AsyncAPI document is published.'
  humanURL: https://github.com/openclarity/apiclarity/tree/master/api3
  tags:
  - Webhooks
  - Notifications
  - Events
  properties:
  - type: OpenAPI
    url: openapi/apiclarity-notifications-openapi.yml
  - type: Webhooks
    url: asyncapi/apiclarity-notifications-webhooks.yml
  - type: Overlay
    url: overlays/apiclarity-notifications-overlay.yaml
  - type: Documentation
    url: https://github.com/openclarity/apiclarity/tree/master/api3#apiclarity-notification-specification
  - type: GitHubRepository
    url: https://github.com/openclarity/apiclarity
common:
- type: AgenticAccess
  url: agentic-access/apiclarity-agentic-access.yml
- type: Packages
  url: packages/apiclarity-packages.yml
- type: SDKs
  url: packages/apiclarity-packages.yml
- type: Conventions
  url: conventions/apiclarity-conventions.yml
- type: Conformance
  url: conformance/apiclarity-conformance.yml
- type: ErrorCatalog
  url: errors/apiclarity-problem-types.yml
- type: Lifecycle
  url: lifecycle/apiclarity-lifecycle.yml
- type: ChangeLog
  url: changelog/apiclarity-changelog.yml
- type: Sandbox
  url: sandbox/apiclarity-sandbox.yml
- type: DataModel
  url: data-model/apiclarity-data-model.yml
- type: Webhooks
  url: asyncapi/apiclarity-notifications-webhooks.yml
- type: AgentSkill
  url: skills/_index.yml
- type: LLMsTxt
  url: llms/apiclarity-llms.txt
- type: X-MCPServerCandidate
  url: mcp/apiclarity-mcp.yml
- type: Plans
  url: plans/apiclarity-plans-pricing.yml
- type: RateLimits
  url: rate-limits/apiclarity-rate-limits.yml
- type: GettingStarted
  url: https://github.com/openclarity/apiclarity#getting-started
- type: APIReference
  url: https://github.com/openclarity/apiclarity/tree/master/api3
- type: Support
  url: https://github.com/openclarity/apiclarity/issues
- type: DomainSecurity
  url: security/apiclarity-domain-security.yml
- type: Authentication
  url: authentication/apiclarity-authentication.yml
- type: Website
  url: https://github.com/openclarity/apiclarity
- type: GitHubOrganization
  url: https://github.com/openclarity
- type: GitHubRepository
  url: https://github.com/openclarity/apiclarity
- type: Documentation
  url: https://github.com/openclarity/apiclarity#readme
- type: Issues
  url: https://github.com/openclarity/apiclarity/issues
- type: ReleaseNotes
  url: https://github.com/openclarity/apiclarity/releases
- type: License
  url: https://github.com/openclarity/apiclarity/blob/master/LICENSE
- type: Slack
  url: https://outshift.slack.com
- type: Features
  data:
  - name: OpenAPI Spec Reconstruction
    description: Automatically reconstruct OpenAPI specifications from observed live API traffic without code instrumentation.
  - name: Shadow API Detection
    description: Identify undocumented shadow APIs being called in production that are not reflected in official specifications.
  - name: Zombie API Detection
    description: Detect deprecated or decommissioned API endpoints still receiving traffic in production.
  - name: API Diff Analysis
    description: Compare observed API behavior against documented specifications to identify drifts, changes, and violations.
  - name: API Security Alerts
    description: Generate security findings and alerts based on API traffic analysis and specification violations.
  - name: Kubernetes Integration
    description: Deploy as a sidecar or via Helm charts for integration with Kubernetes service meshes and API gateways.
  - name: API Inventory
    description: Automatically build and maintain an inventory of all APIs discovered in the environment.
- type: UseCases
  data:
  - name: API Discovery
    description: Discover all APIs running in a Kubernetes environment including undocumented and shadow APIs.
  - name: API Security Posture Assessment
    description: Assess API security by detecting shadow APIs, spec violations, and suspicious traffic patterns.
  - name: API Specification Generation
    description: Generate OpenAPI specifications from live traffic for APIs that lack formal documentation.
  - name: API Governance
    description: Enforce API consistency by detecting deviations between actual API behavior and official specifications.
  - name: Incident Response
    description: Investigate API security incidents using traffic analysis, API inventory, and spec diff data.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com

Work with this as data

Every provider here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for providers

9 MCP tools reach this
  • find_providersBrowse and filter every provider in the catalog.
  • get_provider_artifactsEvery artifact this provider publishes, grouped by type.
  • get_provider_operationsEvery operation across all of their OpenAPIs — one call instead of parsing every spec.
  • get_provider_toolsEvery MCP tool they ship, with the operation each wraps.
  • get_provider_evidenceHow each part of their score was established. Free — the basis for a claim should not sit behind it.
  • get_provider_ratingPRO — composite, band, trend and facet scores.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This provider
curl "https://apis.io/api/v1/providers/apiclarity"
All providers
curl "https://apis.io/api/v1/providers?limit=25"
Every operation they expose
curl "https://apis.io/api/v1/providers/apiclarity/operations?limit=25"
How their score was established
curl "https://apis.io/api/v1/providers/apiclarity/evidence"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

A second provider on the same verified email joins the account you already have.