Your OpenAPI says one thing. Your backend may be running another.

FlexDoc compares your OpenAPI contract with the routes your framework actually registered. Find undocumented and missing operations, fail CI on unacknowledged disagreement, inspect the runtime evidence, and reproduce the route without leaving FlexDoc.

Node · Spring MVC · ASP.NET Core

Apache-2.0 · Self-hosted · No control plane required

Try it with Express Choose your framework GitHub

Apache-2.0

Self-hosted

Node · Spring · ASP.NET

Contract validation

No account

No control plane

The loop

From a missing contract to a request you can send.

1. OpenAPI
```
GET /pets
```

2. Running backend

GET /pets
GET /internal/health
POST /internal/reindex

3. flexdoc validate

FAIL

[ERROR] runtime.operation-undocumented
POST /internal/reindex

4. Open the finding

Contract: OpenAPI does not declare this operation
Runtime: POST /internal/reindex is registered

5. API Client
```
Send POST /internal/reindex
```

GET /internal/health can be acknowledged. It stays in the runtime record as informational and does not fail the check. POST /internal/reindex does.

Frameworks

Start where the disagreement loop already runs.

Express, Spring MVC, and ASP.NET Core are the evaluation paths. Other adapters still serve the same docs and API Client. A dash means that capability is not advertised, not that it was guessed.

Framework	Docs	Runtime evidence	Contract validation	API-host execution
Express	Yes	Yes	Yes	Yes
Fastify	Yes	Yes	Yes	Yes
NestJS	Yes	Yes	Yes	Yes
Hono	Yes	Yes	Yes	Yes
Spring MVC	Yes	Yes	Yes	Yes
ASP.NET Core	Yes	Yes	Yes	Yes
FastAPI	Yes	Yes	Route snapshot only	Yes
Rails	Yes	No	No	Yes

Express example →Spring MVC example →ASP.NET Core example →

Choose your stack

Install FlexDoc for your framework.

Choose the framework you already use. Versions are matched by ecosystem + artifact from the canonical release feed, so similarly named Python and Ruby packages cannot collide.

Framework

Package

@prauga/flexdoc-backend

v3.5.0

npm •runnable example

Contract validation is available. Host execution is optional and stays behind an exact-origin allowlist.

The minimal mount shown here does not silently enable server-side egress. Read the security model →

Contract validation reads the routes this framework registered. Host execution can also use cookie jars, client certificates, Digest, Hawk, OAuth 1.0, and AWS SigV4 when that capability is enabled and advertised.

1. Install the Node adapter

install

npm install @prauga/flexdoc-backend@3.5.0

2. Mount FlexDoc

import { setupExpressFlexDoc } from '@prauga/flexdoc-backend';

setupExpressFlexDoc(app, '/docs', {
  spec,
  options: {
    title: 'My API',
    runtimeIntelligence: {
      enabled: true,
      acknowledgedUndocumented: [{ method: 'GET', path: '/internal/health' }],
    },
  },
});

Open /docs. Renderer assets are served locally, so no FlexDoc account or runtime CDN is required.

If you enable POST /docs/__flexdoc/execute, protect the docs subtree with application authentication/authorization, use an exact-origin allowlist and keep an intentional CSRF/rate-limit/concurrency policy. X-FlexDoc-Execute: 1 is not authentication.

Why it knows

The framework registration is the evidence.

OpenAPI is a claim about the API. FlexDoc also reads the routes the running framework registered: the Express router, Spring RequestMappingHandlerMapping, or the ASP.NET Core EndpointDataSource. It does not invent a handler or a schema for a route the contract does not describe.

Understand

Runtime Intelligence reads the routes the framework registered.

Compare

Contract Validation names where that surface disagrees with OpenAPI.

Reproduce

The finding opens the route in the API Client. Host execution covers a target the browser cannot reach.

Automate

flexdoc validate fails CI. The Runner repeats saved requests.

Host execution is the reproduce path when the browser cannot reach the API. It is not the front door. Read the security model →

Also in the workbench

The rest of FlexDoc supports that loop.

API Client

Collections, scripts, History, and Postman import live in the same request workspace a finding opens.

OpenAPI renderer

The docs surface still renders OpenAPI 3.0 and 3.1, with Try It beside the contract.

Runner

Export a saved request or collection and run it in CI with flexdoc run.

Host execution

When the browser cannot reach the API, an approved request can run from the service network. Exact origins stay required.

Open source where it runs

The renderer, API Client, CLI, Runner, Runtime Intelligence, Contract Validation, and framework adapters are Apache-2.0. No FlexDoc account, telemetry service, or hosted control plane is required.

View source SECURITY.md Apache-2.0 Runtime vs OpenAPI

Compare the contract with the routes that are registered.

Start with Express, Spring MVC, or ASP.NET Core. The same workbench renders the contract, names the disagreement, and opens the route.

Install FlexDoc GitHub