# App2Api

A tool that reverse-engineers the real API behind a mobile app you own or are authorized to test, then hands an AI agent a runnable call and an OpenAPI spec for it.

App2Api captures the real network traffic behind one workflow of a mobile app, such as a login or a specific in-app action, that you own or are authorized to test. Given the app and a plain-English goal, it drives a live emulator toward that goal with a vision-based planner, records every HTTPS call the app makes, and traces the action back to the request that triggered it, following the chain to session bootstrap, tokens, and attestation.

The result is three files: a runnable script that reproduces the call standalone, an OpenAPI 3.1 specification for the endpoints the workflow touched, and an owner report that can be shared with a teammate or client. Any credentials used during the capture are typed locally and never sent to a model.

It is aimed at mobile, backend, QA, and security teams who want to document their own app's real API surface, catch undeclared endpoints, or get a contract they can test against. It is currently a free beta.

Website: https://app2api.com/