What GitAPITaker is

A privacy-first, keyboard-driven developer tool that resolves Git hosting URLs into their provider REST API endpoints and lets you inspect the resulting responses — JSON, RAW body, headers and the exact request — with total transparency about what is live and what is cached. The resolution pipeline at the top of every inspection shows exactly what was detected, parsed, resolved and fetched.

Architecture

• Static frontend only. Deployable on GitHub Pages. There is no GitAPITaker backend, API proxy, request relay, telemetry service, analytics system or application-owned database.
• Direct requests. Every API call goes from your browser straight to the provider (GitHub, GitLab, Gitea, or a self-hosted instance you register). GitAPITaker never sits in the middle.
• Provider adapters. Detection, URL parsing and endpoint resolution are separate stages; each provider adapter owns its own mapping rules, versioning quirks and capability metadata.

Privacy

• No analytics, no telemetry, no tracking pixels, no third-party behavioral tracking, no request-logging servers. No web fonts are loaded — system font stacks only.
• The URLs you inspect, your history, your cache and your theme preference are stored only in this browser’s localStorage. GitAPITaker never transmits them anywhere.
• Share links contain only the target resource URL — never responses, tokens or cache data.
• Requests use credentials: "omit": no cookies are sent to provider APIs.
• The community widget (Giscus) is loaded only on the Community page and communicates with GitHub, not with GitAPITaker infrastructure.

Important honesty note: the provider you inspect does receive your request — it is the actual API destination. Provider rate limits, terms and privacy policies apply to those requests.

Caching

Responses are cached in localStorage with full context: endpoint, status, headers, exact body, request metadata, fetch time and TTL (5 minutes by default). Cache keys include provider, method and full endpoint URL so unrelated requests never collide. A response is always labeled LIVE, CACHED or STALE — text labels, not color alone. A cached response is never displayed as fresh, and a 200 OK from cache always carries the CACHED/STALE badge and the original fetch time.

Request Guard

The Request Guard is a local safety mechanism: after a live request, repeated identical requests within 10 seconds are suppressed and served from the local cache. The UI tells you when this happens — how many repeats were suppressed this session, and when a live request is allowed again. r (or the Refresh button) forces a live request. It exists to keep the interface responsive and to protect third-party APIs from accidental hammering. It is not designed to bypass provider rate limits, and GitAPITaker never rotates identities, proxies requests, or otherwise circumvents provider protections. Provider rate limits still fully apply to every live request.

Offline mode

When a provider cannot be reached (or you are offline), previously cached responses remain fully inspectable — all four views work from the cached record. Such responses are always labeled STALE with the original fetch timestamp.

Authentication (future)

GitAPITaker v0.1 performs unauthenticated requests only. If authentication is added later, tokens will never be placed in URLs, query parameters, share links, history or cache records; the default will be memory-only storage, and browser-local storage risks will be spelled out before any opt-in persistence.

Known limitations

• github.com/{name} is ambiguous (user vs organization); the users endpoint is tried first and the 404 interpretation offers a one-click “try as organization” action.
• GitLab user lookup returns an array (/users?username=); related resources for a single GitLab user need the numeric id from that response.
• tree/blob URLs mix a git ref and a path; the first segment is treated as the ref (heuristic, labeled in the REQUEST view).
• Browsers only expose response headers allowed by CORS; the HEADERS view says so explicitly.
• Some self-hosted instances disable CORS for their API; browser requests to them will fail and the error interpretation explains this.
• GitAPITaker performs GET requests only.