Importing HAR traffic

No OpenAPI spec? Record the API being used in your browser and import the recording. A HAR file is raw traffic, so the import has facts to work from (real requests and responses) and nothing to guess about scripts or variables. It creates a new API with:

• operations grouped into resources from the URL paths,
• a contract per operation (query parameters with inferred types, request body schemas, response codes),
• one request instance per distinct call, with its real values,
• a local environment with the recorded base URL.

1. Record

In Chrome, Edge or Firefox DevTools, open Network, use the app normally, then Save all as HAR (the download icon, or right-click in the request list). The file contains real headers: treat it like a secret and don't commit it.

2. Preview

craftr import har plan ./traffic.har

The import keeps API calls only (XHR and fetch; scripts, styles, images and fonts are skipped), keeps the most frequent host (--host picks another), and drops exact repeats. Numeric, UUID and long hex path segments become parameters named after the previous segment: /timers/42 → /timers/{timerId}.

The plan lists the resources, operations and instances it would create, the host counts, what was skipped, and the secret candidates.

In the app, open the New API wizard and pick Import a HAR file under the name field. After Analyze, a host selector appears when the recording spans several.

3. Decide the secrets

A DevTools recording contains your real Authorization header and session cookies. They never land in a committed file: every header, query parameter or cookie whose name looks like a credential is a candidate you decide before anything is written.

• secret: the value goes to local.secrets.env; the request references {{variable}}. A Bearer authorization header becomes the request's bearer auth.
• drop: the parameter is left out of every request.

craftr import har apply ./traffic.har --secret header:authorization --drop cookie:session
craftr import har apply ./traffic.har --api shop-api --secret-all

On a terminal, undecided candidates are asked interactively; in a pipeline the command fails and lists them. Like every import, it refuses an API slug that already exists.

After the import

HAR has no names: resources and operations are named from paths and methods (list, get, create, …, or <method><Segment> when nothing fits), and instances <method>-<segment>. Rename them freely, and remap with schema rules.

The inferred contracts are a starting point taken from one recording. Correct them in the operation's Definition tab, then promote them to a spec once they're right.