From first capture to a reusable dataset.

1. Install and open Guardian

Install an unpacked build

1. Extract the release ZIP to a permanent folder.
2. Open chrome://extensions.
3. Enable Developer mode.
4. Select Load unpacked and choose the folder containing manifest.json.

Open the DevTools panel

1. Open a website you are authorized to inspect.
2. Open Chrome DevTools with F12, Ctrl+Shift+I, or Inspect.
3. Select Contract Guardian. Use the overflow menu if the tab is hidden.
4. Keep the panel open and reload the page.

Guardian sees requests completed while its DevTools panel is active. Cached or service-worker responses may require one additional reload before Chrome exposes their response body.

2. Capture API traffic

The Traffic tab observes Fetch, XHR, JSON, GraphQL, XML, and API-like requests from the inspected tab.

• Search by method, URL, host, or response status.
• Select the Capturing pill to pause capture globally. Select Paused to resume.
• Select a request to inspect its inferred contract, request body, response body, and sanitized headers.
• Select Clear to remove current traffic without deleting saved contract baselines.
• Reloading or navigating begins a clean capture session automatically.

Captured response bodies remain in memory for the current DevTools session and are not written to extension storage.

3. Monitor contract drift

The first JSON response for a normalized endpoint becomes its local baseline. Numeric IDs, UUIDs, and long hexadecimal keys in URL paths are normalized so related records share one contract.

Pin what matters

Drift is checked only for pinned contracts. Pin an endpoint from Contracts or directly from an API Finder candidate. Pinning starts a fresh monitoring window.

• Breaking: removed fields and incompatible type changes.
• Suspicious: structural changes that deserve review.
• Safe: additive fields that preserve the previous shape.

Select the Drifted APIs metric for an endpoint-grouped breakdown containing every changed JSON path. Use Save current baseline after confirming an intentional API change.

Manage baselines

• Search contracts by endpoint, method, or host.
• Pin important baselines to protect them from bulk cleanup.
• Delete an individual baseline from its card.
• Delete all unpinned preserves every pinned contract.
• Export contract JSON periodically when you need a backup.

4. Configure AI

Choose the active provider from the panel header. Deterministic ranking works without an AI call.

Local Ollama

1. Install Ollama.
2. Pull a text-oriented model such as qwen3:8b.
3. Allow the extension origin through OLLAMA_ORIGINS.
4. Keep Ollama running at http://localhost:11434.
5. Enter the endpoint and model in Guardian settings.

Ollama traffic remains on the local machine. Guardian reads the active model context allocation and limits evidence to fit.

External providers

OpenAI, Claude, OpenRouter, and ZenMux use your own key. Keys are saved in Chrome local storage. Selecting an external provider displays a warning, and API Finder requires acknowledgement before every external investigation.

Secret-like fields and query parameters are redacted, authorization and cookie headers are excluded, and response evidence is bounded. Avoid external providers for confidential traffic unless your provider agreement permits it.

5. Find the API powering a page

1. Capture the page load and interaction that displays the target data.
2. Open API Finder and ask a direct question such as “Which request populates the product cards?”
3. Paste two or three visible examples, one per line.
4. Enter expected fields such as title, price, image, slug.
5. Choose the number of candidates to display and keep third-party traffic hidden unless it is required.
6. Review the ranked table or ask the selected AI for an evidence report.

The ranker favors first-party API-like requests, JSON object arrays, useful collection sizes, matching visible values, and expected fields. Trackers, advertising hosts, and static assets receive strong penalties. Repeated calls to the same normalized endpoint are collapsed into one candidate.

Each result offers safe URL and cURL copying, request inspection, contract pinning, and direct handoff to Payload Lab.

6. Activate Payload Lab Pro

Payload Lab Pro costs $129 as a one-time purchase. One license supports up to three activated devices.

1. Purchase Pro through the Lemon Squeezy checkout.
2. Open Payload Lab and paste the key from the receipt.
3. Select Activate Pro.

Guardian creates one Lemon Squeezy instance per installation, validates at most daily, and provides a seven-day offline grace period after successful validation. Deactivate an installation before replacing a device when all three slots are in use.

7. Build an extraction recipe

1. Select a captured JSON response.
2. Enter a recipe name.
3. Enter a collection path such as data.products, or choose one from the complete response-path browser.
4. Select Suggest paths to list nested fields inside the chosen collection.
5. Add, remove, or rename output fields.
6. Select Test extraction and inspect the resulting rows.

The path browser examines the complete response. Selecting any path places it in the Collection path input and expands its nested value. For arrays, discovery examines every item so fields appearing only in later objects are included.

data.products
seller.name
variants[0].sku

8. Export results

Generated calls intentionally exclude captured cookies and authorization headers. Some APIs may still require a browser session or documented authentication.

9. Troubleshooting

No requests appear

• Confirm DevTools and Guardian were open before the request completed.
• Confirm capture is not paused.
• Reload and repeat the interaction.
• Check that Chrome is not paused at a JavaScript breakpoint.

A request has no response body

Chrome may withhold cached, service-worker, or navigation-detached content. Keep Guardian open and reload once more.

The wrong API ranks highly

Add visible samples and expected fields, keep third-party traffic hidden, and confirm the desired call completed in the current session.

Ollama is slow or reports an oversized prompt

Use a faster text-oriented model or increase the model’s context allocation. Multimodal models such as LLaVA offer little benefit for text and JSON investigation.

License activation fails

Confirm the key belongs to API Contract Guardian variant 1952527, has an available activation, and can reach api.lemonsqueezy.com.