Private API cartography
Every app knows
more than it
tells you.
The software you pay for exposes far more through its own interface than through any documented API, and writes none of it down. Netjive watches what an app actually does while you use it, turns that into a searchable endpoint map, and makes the map callable under guardrails.
- GET/api/v1/accounts/{accountId}/warmup★read
- POST/api/v1/warmup/{warmupId}/pause★write
- GET/api/v1/suppression★read
- GET/api/v1/campaignsread
- GET/api/v1/mailboxes/{mailboxId}read
- DELETE/api/v1/sequence/{sequenceId}delete
★ matched a priority pattern
An illustration of the readout. The kind of surface a capture reveals: warm-up and suppression endpoints a vendor documents nowhere and never surfaces in its own UI.
Observe
A browser extension rides your authenticated session and records every request the app makes. No credentials are read, stored, or forwarded.
Map
Requests collapse into URL templates, typed parameters, and observed request and response shapes. The registry is the durable asset.
Call
Endpoints become callable, host-allowlisted and read-only by default. Every invocation is written to an audit trail with its intent.
Instruments
API Mapper
mutating→Points a browser extension at an authenticated web app and records every private API call it makes, producing a searchable endpoint catalog for an app that ships no documentation.
Endpoint Search
→Semantic search over the endpoint map. Ask which endpoint controls a behaviour instead of grepping a catalog of several hundred routes.
Sender Audit
→Checks the mail posture of a domain you already operate, optional breach membership for addresses you already have, and optional reputation on landing URLs. Every fetch is stamped on a run.
Company Records
→Looks up a name, ticker, or CIK you already have against SEC EDGAR, OpenSanctions, USAspending, and optional Companies House. Ambiguous names stay unresolved. Every fetch is stamped on a run.