Frequently asked questions

apiheron shows what your frontend does with the API responses it receives: which fields the code reads, how long requests take, how large responses are and which calls repeat. An SDK in your app records this from real use, and apiheron turns the record into findings, each with the requests and the code location behind it.

No. apiheron collects no server metrics, traces or logs. It runs in the browser and shows what the frontend reads of each response, which a server-side tool cannot see. It is a development tool for finding waste, not an alerting system, and should not be relied on during a production incident.

Any frontend that reads JSON over fetch or XMLHttpRequest, which covers axios, jQuery and Angular without extra wiring; there is a TanStack Query integration too. Setup has ready snippets for Next.js, Vite and plain HTML. Only requests made in the browser are recorded: on the server the SDK does nothing, and responses that are not JSON are skipped.

You do not change how your app fetches. You add one script tag to the page head, or call init() from the npm package, and requests made through fetch and XMLHttpRequest are captured from then on. Connecting axios or TanStack Query is optional, one line each. The JSON your code receives is wrapped so that reads can be observed; pass it through unwrap() before structuredClone, postMessage or IndexedDB. To remove apiheron, delete that tag or call: without it nothing is patched.

This is what runs in your page: the SDK wraps fetch, XMLHttpRequest and JSON.parse, reads each JSON body a second time to record its shape, and hands your code a wrapped object so it can note which fields are read. It sends what it collected in one batch, every 2 seconds by default. Turning that record into findings happens on apiheron’s servers, not in the browser. The script is about 14 KB gzipped. We do not publish an overhead figure: compare your own pages with the SDK on and off. sampleRate skips all of this on page loads that are not sampled; ignore only leaves chosen URLs out of the record.

Your requests do not go through apiheron: the SDK calls the browser’s own fetch and XMLHttpRequest and reports separately. Its code around those calls is guarded, so if the SDK’s own code fails there, your app still gets the browser’s original response. If apiheron cannot be reached, the batch that failed is dropped, sending pauses for a while and one warning is written to the console; events still waiting sit in a bounded buffer, and the oldest are dropped when it fills.

Yes. The Next.js and Vite snippets load the script in development only, so production is a deliberate step there; a plain HTML tag loads wherever that page is served. In production, sampleRate records a share of page loads so a busy app stays within its quota, and uploaded source maps turn minified call sites back into the original file and line (Team plan and above). Each recorded page load stays complete, so findings still hold; counts cover only the sample.

Response values do not leave the page. For each JSON response the SDK sends its shape and its use: method, URL, status, timing and size, the paths of its fields (for example items[].price), which of them your code read, the page path, the code location that made the request, a session id and the SDK version; a scenario name too, if you set one. Object keys count as field names, so a response keyed by ids or email addresses sends those keys. In the request URL, query values and path segments that look like ids (numbers, UUIDs, long tokens, email addresses) are replaced by a short hash that keeps equal values comparable; this is masking, not anonymisation. Other path segments and the path of your own page are sent as they are. Request bodies are not sent, only a hash of each; for GraphQL the operation name is sent too.

It is off by default. Turned on, the SDK also sends each request’s URL and body as sent, so a request can be copied from apiheron as a runnable cURL command. In query strings and in JSON and form-encoded bodies, fields named like passwords, tokens or keys are replaced with ***; other text bodies and the URL path are sent as they are. FormData, files and bodies over 8 KB are skipped, and headers are still not read. Personal data in those URLs and bodies is stored as sent, so turn it on only where that is acceptable.

The SDK never reads request headers, so it does not see an Authorization header or a cookie. Of a response’s headers it looks only at content type, encoding and length, to recognise JSON and measure its size. A token passed as a query value is masked like any other query value. If a response carries a field named like a credential, such as password or api_key, apiheron reports the field name as a finding (sign-in routes excepted); its value was never sent.

Captured responses are deleted automatically once they pass the retention set on the project, capped by the plan: 7 days on Free, 30 on Team, 90 on Business. Findings stay while the project exists. You can download your organization’s projects, findings, decisions, members, usage and audit log as JSON, and the request and endpoint lists as CSV. You can delete the organization yourself; an account can be deleted once it has no active subscription and is not an organization’s only Owner. Deleting an organization removes its data from the running service immediately and cannot be undone. The database is hosted in the European Union.

Yes, as part of the Enterprise plan. That plan is sized with you: response volume, retention, an annual contract and, if you need it, an installation on your own infrastructure. Use Contact us in the pricing section to start.

Nothing unless you turn it on: the advisor is off by default and runs with your own key for the model provider. It is called when a member with the Developer role or above asks for advice on an endpoint, never in the background. That request carries shape and measurements: the endpoint’s route, its findings, the paths of the fields read and not read, array operations, counts, timing, sizes, page paths and call sites. Response values are not in it, because apiheron does not receive them.

It can be incomplete. “Not read” covers only the sessions apiheron observed: a field that is read on another page, tab or action looks unread until someone uses that flow. That is why each such finding states how many sessions and requests it rests on, and why responses the SDK could not fully track are left out of field claims. A developer can mute a finding or mark it a false positive with a note; treat an unread field as a lead to check in code, not as permission to delete.

One finding is one endpoint with one kind of problem. If it happens 20 times it is still one finding, with the occurrences shown separately. Findings that only occur in development, such as React StrictMode running effects twice, are labelled dev-only and kept out of the count.

50,000 captured responses a month, 7-day retention, every finding kind, 1 member and 2 projects, which is one app’s development and production. No credit card. Team and Business raise the quota and the retention and remove the member and project limits.

Capture pauses until the next calendar month, or until you move to a higher plan. Nothing extra is billed, and data already stored is not affected. The organization’s Owners get an email when the quota is nearly used up and another when capture pauses.

A new organization starts with a 14-day Team trial, without a card. When it ends you stay on the Free plan until you upgrade, so nothing is charged unless you choose a paid plan. Paid plans carry no commitment: you cancel or switch plans yourself, and payments, invoices and taxes are handled by Polar.