apibreak docs finds the curl and fetch examples your spec does not support. See a real run →Which vendor API changes actually touch the endpoints you call
You call thirty endpoints. The vendor changed fourteen hundred things. A CI check reads the list of endpoints you actually call, compares the vendor's own OpenAPI specification against the revision you pinned, and reports the ones that touch yours.
It runs in your CI. It needs no credentials, no repository access, and nothing is uploaded anywhere. The check itself is free and its source is public.
Why this exists, in numbers rather than adjectives
Between 26 March 2026 and 25 September 2026, the GitHub REST specification went from 1107 operations to 1224. In that window it removed 25 and newly deprecated 7. 38 operations in the current specification are marked deprecated: the vendor has flagged them for possible removal, with or without a date attached.
Vendors announce changes in changelogs, response headers and sometimes email. None of those announcements is filtered to the endpoints you call. That filter is the whole product.
Measured from github/rest-api-description at f31bdfd and 0029c0d. Every operation, named.
Two files and you are done
A manifest listing what you call and the specification revision you last reconciled against:
{
"version": 1,
"integrations": [
{
"vendor": "github",
"baseline": "2026-03-19",
"endpoints": [
"GET /repos/{owner}/{repo}/issues",
"POST /repos/{owner}/{repo}/check-runs"
]
}
]
}And a workflow:
# .github/workflows/apibreak.yml
name: apibreak
on:
schedule: [{ cron: "0 7 * * 1" }]
workflow_dispatch:
jobs:
apibreak:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: Skyblueballykid/apibreak@v1
with:
manifest: apibreak.json
fail-on: breakingThe run writes a table into your job summary and exits non-zero when something breaking lands. Exit code 2 is a breaking finding, 1 is a problem with the manifest, 0 is nothing to do.
What it reports, and only this
- Removed operations — in your pinned revision, gone from the current one.
- Newly deprecated operations — the notice period, while you still have one.
- Request fields that became required — at any depth, including inside array elements — and parameters that became required, including the ones a vendor declares once on the path and never repeats. A new required field inside a brand-new optional object is not reported: nobody was sending that object.
- Fields that changed type, and fields that were unrestricted and now accept only a fixed set.
- Request or response fields that disappeared. A response field vanishing is the change that breaks a parser without anyone announcing it.
- Enum members that no longer exist, with the values that replaced them.
Purely additive changes are counted and not listed. A check that reports every new optional field teaches you to ignore it.
What it refuses to do
- It does not read your source code, and it does not want access to your repository.
- It does not take credentials, API keys or traffic.
- It does not fix anything automatically.
- It does not claim complete coverage. A schema it cannot read honestly — a
oneOfunion, an unresolvable reference, a chain deeper than it follows — is reported as not compared, on every run, never as clean. Those rows do not fail your build: they are a standing limit, not a failure. An endpoint it could not read at all is unknown and does fail, because a check that could not look is not a check that passed. - It does not compare fields a vendor never enumerated. A free-form
objecthas nothing to remove; if a vendor stops enumerating fields it used to list, that is reported as not compared rather than as a pile of removals. - It does not tell you your integration is broken. Where a vendor pins API versions per account, as Stripe does, a specification change is an upgrade impact, and the report says so in those words.
Vendors it knows, and why those
Each vendor here was measured before it was supported. A vendor whose specification does not move is not a monitoring subject, and adding names to look impressive would make every report less trustworthy.
GitHub REST
what changedGitHub's REST API is versioned by date. The X-GitHub-Api-Version header selects a version, and a request without it defaults to 2022-11-28. When a new version is released, GitHub supports the previous one for at least 24 more months. APIBreak diffs api.github.com.json, the unversioned description in github/rest-api-description, not the per-version files, so check a change listed here against the version you send.
Stripe
what changedEach Stripe account has a default API version, and a request uses it unless the Stripe-Version header or the SDK sets another, so a specification change is an upgrade question rather than an outage. Findings here are worded as upgrade impact.
Twilio — deliberately not supported
Its api_v2010 specification did not add, remove or deprecate one operation in six months: 197 operations before, 197 after. Charging to watch it would be charging for very little.
Measured again for its change page: 197 operations on 14 April 2026, 197 on 6 October 2026, 0 removed, 0 newly deprecated, 1 request field dropped.
Measured for a change page, not yet checked by the Action: Asana, Cloudflare, Datadog, Discord, Docker Engine, Figma, Grafana, Klaviyo, Kubernetes, Mailchimp Marketing, Okta Management, OpenAI, PagerDuty, Plaid, Qdrant, Resend, Sentry, Square, Supabase Management, Twilio. Every vendor's API changes.
The part that costs money
The check is free and always will be — it runs on your machines and you can read every line of it. $49 per month, per organisation, buys the same check run daily against up to three manifests, and the report emailed to you, without a scheduled workflow to keep in each repository. The free Action can run on a schedule too; Hosted would manage that schedule for you.
It is early access and priced as a proposal. There is no SLA, no real-time guarantee and no promise of complete coverage, and I would rather say that here than discover it with you later.
Order the hosted version conditionally — no card is taken and nothing is charged unless we deliver against criteria you write and you accept. The order is private: it is not published anywhere, and it does not ask for your endpoint list.
Questions about the free check go to the repository's issues, where the answer is useful to the next person too.