Install and open Guardian
- Install from the Chrome Web Store, or open
chrome://extensions, enable Developer mode, and load the unpacked release folder. - Open the website you are authorized to inspect, then open Chrome DevTools with F12 or Inspect.
- Select the Contract Guardian panel. Check the DevTools overflow menu if the tab is hidden.
- Keep the panel open and reload the page.
Guardian observes requests completed while its panel is active. Cached or service-worker responses may require one additional reload before Chrome exposes the body.
Capture traffic
The Traffic tab records Fetch, XHR, JSON, GraphQL, XML, and API-like calls from the inspected tab. Filter by method, URL, or status. Select a row to inspect the inferred contract, request body, response, or sanitized headers.
- Clear removes the current session traffic.
- Navigation and reload begin a clean capture session.
- Response bodies stay in memory and are not persisted.
- Saved contract baselines remain available across sessions.
Monitor contract drift
The first JSON response for a normalized endpoint becomes its local baseline. Guardian identifies breaking removals, incompatible type changes, suspicious structural differences, and safe additions.
After reviewing an intentional API change, use Save current baseline. Export the Contracts tab periodically if you need a backup.
Configure AI
Local Ollama
- Install Ollama and pull a text model such as
qwen3:8b. - Allow the extension origin in
OLLAMA_ORIGINS. - Keep Ollama running at
http://localhost:11434. - Enter the endpoint and model in Guardian settings.
External providers
OpenAI, Claude, OpenRouter, and ZenMux use your own key. Selecting one shows an external-data warning. API Finder requires explicit acknowledgement before each external investigation. Secret-like values are redacted and authorization/cookie headers are excluded.
Find the API powering a page
- Capture the page load and interaction that displays the desired data.
- Ask a direct question, such as “Which request populates the product cards?”
- Paste a few visible examples, one per line.
- Enter expected fields such as
title, price, image, slug. - Review the ranked table. Keep third-party traffic hidden unless it is genuinely required.
- Open the strongest candidate in Payload Lab or ask the selected AI for an evidence report.
Activate Payload Lab Pro
- Purchase a license from the configured Lemon Squeezy checkout.
- Open Payload Lab and paste the key from your receipt.
- Select Activate Pro.
Guardian creates one license instance for this installation, validates it no more than daily, and uses a seven-day offline grace period after a successful check. Deactivate the device before moving the activation elsewhere.
Build an extraction recipe
- Select a captured JSON response.
- Enter a recipe name and collection path such as
data.products. - Use the exhaustive response path browser to select and expand any value.
- Select Suggest paths to generate mappings from the chosen collection.
- Rename, add, or remove fields.
- Test extraction and review the rows.
- Export CSV, JavaScript, recipe JSON, or Loompath.
The path browser inspects the complete response. For array collections, discovery checks every item so fields that appear only later are included.
Troubleshooting
No requests appear
Confirm Guardian was open before the request completed, reload, and perform the interaction again.
A request has no body
Chrome may withhold cached or navigation-detached bodies. Keep the panel open and reload once more.
The wrong APIs rank highly
Add visible samples and expected fields, keep third-party traffic hidden, and confirm the desired call completed in this session.
License activation fails
Confirm the key belongs to the configured product, has an available activation, and can reach api.lemonsqueezy.com.