Free tool · runs 100 % in your browser
HAR → OpenAPI + typed SDK.
Without uploading a byte.
Drop a .har exported from DevTools. Contour groups the calls, strips tokens, cookies and e-mails, then writes an OpenAPI 3.1 spec, a TypeScript client and a Python client. The compiler runs on this page: your capture never leaves your machine.
- No signup
- No upload
- Open-source compiler
Paste HAR or signals JSON instead
Only use traffic you are allowed to observe: your app, your staging, a test account.
| Method | Path | Seen | Status | Confidence |
|---|
Compiler notes
That was the 10-minute version.
The 48-hour pack is done with you: several sessions merged, errors and edge cases, auth and pagination, enums checked with your team, a confidence report per operation, and a ready-to-commit repo. Written authorization before any capture. Never your source code.
Fixed price, from $1,750
Export a HAR in 30 seconds
Chrome / Edge
DevTools → Network → reproduce the flow → right-click a request → Save all as HAR. Chrome strips sensitive headers by default since v130; keep it that way.
Firefox
DevTools → Network → gear icon → Save All As HAR.
Safari
Develop → Show Web Inspector → Network → Export.
Questions
Is my HAR uploaded anywhere?
No. The compiler is a 30 KB script that runs in this tab. Open DevTools → Network while you compile: there is no request. The only network call on this page is the optional e-mail form, and it only sends what you type in it.
What gets removed?
Bearer tokens, cookies, API keys such as sk_live, JWTs and e-mail addresses, before any inference. If a secret still looks present, the SDK is not generated. Observed example values are also stripped by default.
How good is the spec?
As good as the traffic. Each operation gets a confidence score based on how many calls back it. One call is a guess; fourteen is a contract. Gaps are listed instead of invented.
Is this reverse engineering someone else's app?
No. Use it on traffic you are authorized to observe. Contour does not decompile, bypass DRM or touch source code. The paid pack starts with a signed authorization.
Limits?
REST/JSON over HTTP, up to 400 requests per run. GraphQL and gRPC are out of scope for the free tool.