Private API cartography

Every app knows
more than it
tells you.

The software you pay for exposes far more through its own interface than through any documented API, and writes none of it down. Netjive watches what an app actually does while you use it, turns that into a searchable endpoint map, and makes the map callable under guardrails.

Sign in→
discovery/registrysample
  • GET/api/v1/accounts/{accountId}/warmup★read
  • POST/api/v1/warmup/{warmupId}/pause★write
  • GET/api/v1/suppression★read
  • GET/api/v1/campaignsread
  • GET/api/v1/mailboxes/{mailboxId}read
  • DELETE/api/v1/sequence/{sequenceId}delete

★ matched a priority pattern

An illustration of the readout. The kind of surface a capture reveals: warm-up and suppression endpoints a vendor documents nowhere and never surfaces in its own UI.

01

Observe

A browser extension rides your authenticated session and records every request the app makes. No credentials are read, stored, or forwarded.

02

Map

Requests collapse into URL templates, typed parameters, and observed request and response shapes. The registry is the durable asset.

03

Call

Endpoints become callable, host-allowlisted and read-only by default. Every invocation is written to an audit trail with its intent.

Instruments

API Mapper

mutating→

Operator-owned sitting: headed Chromium (Chrome unpacked or Netjive Desktop) maps the private HTTP of an app you are logged into. This website stores that map. A write replay is not offered from this host. Front door: TOOLS/session-runtime.

Endpoint Search

→

Search the endpoint map. With vectors, hits are similarity. Without them, each word matches the template, summary, area, key, or effect. Each hit opens on the map.

Sender Audit

→

Checks the mail posture of a domain you already operate, optional breach membership for addresses you already have, and optional reputation on landing URLs. URLScan, when keyed, submits a scan, and that call is stored as an unconfirmed write. Every fetch is stamped on a run.

Company Records

→

Looks up a name, ticker, or CIK you already have against SEC EDGAR, OpenSanctions, USAspending, and optional Companies House. Ambiguous names stay unresolved. Every fetch is stamped on a run.

Grant Records

→

Looks up a keyword against Grants.gov open notices, and a name or UEI you already hold against USAspending assistance awards. SAM.gov joins a listing number when keyed. Ambiguous recipients stay unresolved. Every fetch is stamped on a run.

NextSite Reader