GitHub delivery evidence
Build and verify the change with GitHub context alongside it.
OpenAPIRevisionsSecretsSSRF-safe
Let a teammate ask the API, without asking a developer.
Import your OpenAPI specs, watch the surface change revision by revision, and run real requests with per-environment secrets through a proxy that refuses to hit anything internal.
openapi.yaml · endpoints
- GET21
- POST11
- PATCH6
- DELETE4
47 endpoints18 secured3 deprecated
API Explorer lives in Engineering, beside the build.
One connected loop, held on the stage this capability serves. The other stages stay as context so you can see what feeds in and what comes next.
BD
Discovery
Feedback
Product
Engineering
Release
Reliability
Evidence
Engineering
Build and verify the change.
Available now
VCS insights
Inspect delivery workflow activity in the connected release workspace.
Test intelligence
Investigate test outcomes and flakiness evidence across runs.
API Explorer
Keep API contracts inspectable next to the release that changed them.
Compute pricing
Compare public cloud compute pricing as planning evidence.
Built for OpenAPI
This is a REST workbench. OpenAPI in, real requests out, one call at a time. Git-sourced specs come from GitHub. No GraphQL, no gRPC, no multi-step runners. We do one thing here and we do it properly.
The surface has a history, and it's immutable.
Every sync writes a numbered, immutable revision. Compare any two snapshots and see exactly how the contract moved: endpoints added, operations newly secured, deprecations.
Payments APIrev 16 · immutable
- 16rev 16currentJul 12webhook
commit 8f2c1a4 · content changed
- +6 endpoints
- +2 secured
- 0 deprecated
- 15rev 15Jun 28upload
sha256 3ab9…e71
- +3 endpoints
- +1 secured
- +1 deprecated
- 14rev 14May 30webhook
commit 41d0b9c · content changed
- +11 endpoints
- +4 secured
- +5 deprecated
- 13rev 13May 04manual
sha256 77c2…10a
- 0 endpoints
- +1 secured
- 0 deprecated
- 12rev 12Apr 19scheduled
commit a19e6f2
- +4 endpoints
- 0 secured
- 0 deprecated
A real request, through a proxy that refuses to hit anything internal.
The server-side proxy is permission-gated, resolves and checks the target against SSRF and DNS rebinding, bounds the body and redirects, and writes every execution to the audit log.
POSThttps://api.acme.dev/v3/payments/{id}/refund
- 1Permission checkapiSpec.test
- 2Resolve targetDNS → public IP
- 3SSRF guardblock private + rebinding
- 4Bounded execute256KB · manual redirects · hard timeout
https://api.acme.dev/v3/refund200 · 214msforwarded
http://169.254.169.254/latest/meta-datainternal targetrefused
every execution is permission-gated and written to the audit log
Import once, then it keeps up
Bring a spec in three ways, and the workbench does the rest: it validates the document, snapshots the stats, tracks each revision, and — for GitHub-sourced specs — auto-syncs on every push. From the same place you read an operation, fill its variables and run it.
From a spec to a request you trust.
URL, upload, or a connected repo.
Point at a hosted document, push a file, or connect a GitHub repo where a webhook auto-syncs every push. Each source is validated before it lands.
urluploadgit (GitHub)
URLsynced
Fetch from a URL
Point at a hosted openapi.json or .yaml; re-fetch on demand or on a schedule.
- create
- manual
- scheduled
Uploadsynced
Upload a document
Push raw JSON or YAML straight in — from the dashboard or the uploader CLI.
- create
- upload
GitHubsyncing
Connect a repo
Track a spec at a path on a branch; a webhook auto-syncs every push.
- create
- webhook
- manual
The same variable, resolved per environment.
Named environments scope to org, team, or a single spec, with typed string, url, and secret variables. Secrets are encrypted at rest and never rendered back.
org · team · specstring · url · secretencrypted
variableproductionstaginglocal
BASE_URLurlspec
https://api.acme.com
https://staging.acme.dev
http://localhost:8080
API_TOKENsecretteam
••••••
••••••
—
TENANT_IDstringorg
acme
acme-stg
acme-dev
WEBHOOK_SECRETsecretspec
••••••
—
—
secret · encrypted at rest, never rendered
Every revision, counted.
Each revision records the numbers that matter — endpoints, secured operations, deprecations, models, request bodies — and the operations behind every tag.
per-revision statsmethod mixtag distribution
47
endpoints
18
secured
3
deprecated
29
models
22
request bodies
9
tags
operations by tag
- Payments14
- Customers11
- Invoices8
- Subscriptions6
- Webhooks4
Overview, request, recent — per operation.
Open an endpoint to read its params, body, responses, and security; fill the variables and run it; then check the recent runs, all in one pane.
overviewrequestrecent
- 01
Overview
params, body, responses, security
- 02
Request
fill variables, then execute
- 03
Recent
your last runs for this operation
Push the spec straight from your pipeline.
The published uploader sends a fresh document on every build, so the tracked contract never drifts from the code. It runs in GitHub Actions or any generic CI.
@lubed/api-spec-uploaderlube-openapiCI-native
@lubed/api-spec-uploaderci · pipeline
npm i -g @lubed/api-spec-uploader
lube-openapi --api-spec-id spec_9f2 --file openapi.yaml --message "release v3.2"
rev 16 · endpoints 47 · content changed
- GitHub Actions
- generic CI
Nobody should have to ping an engineer to read the docs.
Someone in customer success needs to know if there’s an endpoint for bulk refunds. Today that means pinging an engineer, who then digs up the docs, or worse, turns on a tool and walks them through it. The answer exists. Getting to it costs two people an afternoon.
MCP Explorer will expose your tracked specs as a Model Context Protocol server, so a teammate’s AI assistant can search the surface, read the schema, and draft the call. Share a spec with a link and they explore it directly. Every request still runs through the same permissioned, SSRF-hardened proxy, so self-serve never means unsafe. It’s on the roadmap — the tracked specs and the safe proxy it builds on are here today.
Old way · waits on a dev
“Which call handles refunds? Can you enable the docs for me?”
With lube · self-serve
Will ask the MCP Explorer, find the endpoint, and run it in the sandbox.
MCP Explorer
Customer success
Support
Partner engineer
AI assistant
Search the surface
Ask in plain language; the MCP server returns matching endpoints and schemas.
Share a spec link
Hand a colleague a link instead of a screenshot of the docs.
Run it safely
Calls still pass permissions and the SSRF-safe proxy, and land in the audit log.
The details that make it trustworthy.
Import sources, sync triggers, variable types, and per-revision stats are all first-class, so the contract keeps up with the code.
Spec sources
Three ways in.
urluploadgit (GitHub)
Sync triggers
How a re-check fires.
createmanualscheduledwebhookupload
Variable types
With scopes.
stringurlsecretorgteamspec
Methods tracked
Counted per revision.
GETPOSTPUTPATCHDELETEHEADOPTIONS
Spec stats
Health over time.
endpoint countdeprecatedsecuredmodelstags
Proxy limits
Safety by default.
256KB bodymanual redirecthard timeoutbounded uploads
See what the contract implements.
Stop being the person who gets asked about the API.
Start free
Bring one OpenAPI document and start.