API Profile Guard

Local request guard / v0.1.0

Block API requests to the wrong environment

For developers switching dev, staging, and production before they run a request.

Try it with sample data

See a blocked production request now.

  • Runs on your machine
  • No account
  • Free, MIT licensed
cargo install --git https://github.com/B-Divyesh/sf-api-profile-guard.git --locked api-profile-guard
Three API request streams meet an inspection gate; one safe stream passes while a stop paddle blocks another.
Fig. 01 The guard checks local policy before your API client starts.

Check a request in three steps

  1. 01ReadOpen the named environment file as text.
  2. 02CheckMatch the host, operation, body, and production confirmation phrase.
  3. 03RunStart the API client only when every check passes.

Sample check / 02

Check a request in your browser

Change the sample request and check its policy result. The browser sends no input and starts no client.

Use an absolute URL to check its host.

READY

No request checked yet

Choose an environment and operation. Then check the request.

    Production policy / 03

    Require a confirmation for production requests

    Production requests need an exact host, an allowed operation, and the configured production confirmation phrase.

    apg.tomllocal / reviewable
    # Secrets stay in .env.prod
[profiles.production]
env_file = ".env.prod"
required = ["API_BASE_URL", "API_TOKEN"]
credential_class = "live"
production = true
acknowledgement = "production"

allowed_hosts = ["api.example.com"]
allow = ["GET /v1/*", "POST /v1/orders"]
deny = ["* /v1/admin/*"]

    Read environment files as text

    APG rejects shell expansion and command substitution.

    Save receipts without request values

    Receipts exclude environment values, headers, query strings, and request bodies.

    Block before the client starts

    A blocked run does not start curl, Bruno, or your script.

    CLI demo / 04

    Run the bundled CLI sample

    apg demo creates a temporary workspace. It shows one blocked request and one allowed request.

    Captured from apg demotemporary paths shortened

    One binary / no account

    Install the production request guard

    Build the MIT-licensed Rust binary from the public source.

    Install from source