API Conformance Workbench

Read-only by construction

The workbench refuses every method except GET and HEAD, and only operations the contract marks read-only. Endpoint URLs and headers live in memory: never in a URL, never in local storage, never in a service-worker cache, and redacted from every exported report.

Only the read-only GET operations from the ARC-20 contract can be sent here, one explicit press at a time, at most two at once, never faster than five per second. Your endpoint URL and any headers stay in this page's memory only: never in a URL, never in storage, never in a cache, and removed from every exported report.

Endpoint origin Send Abort Forget endpoint

Nothing sent. No request is made until you press Send.

Compare endpoints

Capture a verdict into one of three slots and compare them side by side.

Capture into slot A Capture into slot B Capture into slot C

What is checked

Status against the contract, media type, JSON parsing, schema validation through build-time standalone validators, error shape, pagination behaviour, and contract-required headers. Each check reports individually. The verdict distinguishes compatible, compatible-with-warnings, schema divergence, wrong network, stale, unreachable, and unknown, and never infers identity fields from unrelated responses.

Local proxy for CORS-blocked endpoints

Run npm run lab:proxy. The proxy binds 127.0.0.1, requires an explicit target allowlist, refuses wildcards, blocks private, loopback, link-local, and metadata destinations (except the local Regtest Lab), re-resolves destinations per request against DNS rebinding, enforces method, timeout, rate, and size limits, strips hop-by-hop headers, persists nothing, and redacts its logs. The hosted documentation site never operates as a proxy.

Relation to the offline explorer

The offline API explorer remains the default reading surface. The live bench is an addition for validating an implementation, not a replacement.