Spec0

Free desktop app

Studio

A native macOS client where the OpenAPI spec is the organising primitive: requests generated from the spec, responses checked against it, and schemas you can browse rather than hunt for. Free, open source, and it works with no account at all.

Universal build for Apple silicon and Intel · macOS 11+ · signed and notarized by Apple · free and MIT licensed

The idea

Stop describing your API twice.

Most API clients ask you to rebuild, by hand, something you already have. You own a spec that says what the endpoints are, what the parameters mean, and what a valid response looks like — and then you maintain a collection that says the same thing, less precisely, and drifts the moment the API changes.

Studio starts from the spec instead. Requests are generated from it, responses are checked against it, and when the contract changes the client changes with it. There's nothing to re-record.

POST /v1/orders 201

Body — generated from the schema

{
  "customerId": "cus_4Qk28Rd",
  "currency": "EUR",
  "items": [{ "sku": "SKU-1042", "qty": 2 }]
}
checked against 201 schema ✓ no drift
⌘↵ send · ⌘P switch API · ⌘E environments

What's in it

A real client, not a spec viewer.

Requests built from the schema

Parameters typed by what the spec says they are — an enum becomes a select, a boolean a toggle. Bodies arrive pre-populated with real field names and format-aware values.

no collection to maintain

Schemas are first-class

Operations and component schemas are two separate tabs, not one buried in the other. Merged allOf fields, what references what, and an interactive graph.

browse, don't hunt

Responses checked against the contract

Validated against the schema declared for the status code actually returned — including fields the response contains that the spec doesn't declare, which is how drift usually shows up first.

including undeclared fields

Conformance runs

Run a tag or the whole spec and get a verdict per operation. The assertions come from the spec, so nobody wrote them and they can't rot. Exportable as markdown for a PR.

read-only by default

No CORS, ever

Requests execute in Rust rather than the webview, so there's no preflight and no browser origin. Point it at localhost, a host the spec never mentions, or your own API.

native HTTP

Built for corporate networks

Per-host certificate trust with a private CA bundle, proxy support honouring HTTPS_PROXY and NO_PROXY, configurable timeouts, redirect chains reported, per-API cookie jars.

the things that decide it works

Privacy

A client for internal APIs has no business talking to anyone else.

Studio makes no request you didn't ask for. No telemetry, no analytics, no crash reporting.

  • The rendered reference never fetches

    The renderer is handed the document text, never a URL. A spec whose description references a remote image will not load it — that request would tell whoever wrote the spec that you opened it.

  • A content security policy enforces it

    Not a promise about today's dependencies — a policy on the webview that holds regardless of what any bundled library decides to do in a future version.

  • One secret store, not two

    Auth values are never stored per API. They live in an environment where they can be marked secret, so a bearer token can't quietly become a second, worse secret store.

  • Certificate trust is deliberate

    Per-host, and there is no global "ignore TLS errors" switch — that's how a tool teaches people to stop reading warnings. Skipping verification for a host is shown at send time.

Free, open source, and it works with no account.

Opening a spec, browsing operations and schemas, firing requests, checking responses, managing environments and history — all of it works offline with no sign-in. Connecting a spec0 organisation adds your team's catalog and hosted mocks; signing out reverts to purely local and loses nothing.

Universal build for Apple silicon and Intel · macOS 11 or later · signed and notarized by Apple, so it opens without a Gatekeeper warning · MIT licensed