API Catalog: automatic API discovery from code · Evlio API Catalog Every endpoint you own, including the ones nobody documented Connect a repo and Evlio reads your code, generates the specs you never wrote, groups endpoints into collections, and scores each one. No OpenAPI file required to start. Connect a repo See it on a demo repo Spec generation from code Rescan on every commit Consumption data Unlimited endpoints API catalog synced 2m ago acme/payments-api · main endpoints 214 collections 5 specs written 83 agent-ready 73% Payments v2.4.1 38 endpoints A · 92% Identity & Auth v1.9.0 24 endpoints B · 84% Legacy Billing no spec in repo 17 endpoints D · 61% Orders v3.0.2 52 endpoints B · 81% Internal tooling · Webhooks 83 endpoints 83 specs written by Evlio, none existed in the repo 214 ENDPOINTS FOUND 83 SPECS EVLIO WROTE 42 SECONDS TO FIRST CATALOG 31 ORPHANED ENDPOINTS SURFACED 01 Discovery Your code is the source of truth, not a stale spec file Evlio reads routes, handlers, types, and validators straight from the repo. Where a spec exists it is imported and diffed. Where it does not, one is written for you, and it stays accurate because the scan reruns on every commit. evlio scan ❯ evlio scan acme/payments-api ▸ Detecting frameworks .............. express, fastapi ▸ Reading routes and handlers ....... 1,204 files ▸ Endpoints discovered ............ 214 ▸ Specs found in repo ............. 131 imported ▸ Specs generated from code ........ 83 written ▸ Labeling and grouping ............ 6 collections ▸ Scoring endpoints ............... 73% agent-ready 31 endpoints have no callers anywhere in the repo 4 endpoints expose PII with no auth defined ✓ catalog ready · 42s · rescan armed on every commit Works without OpenAPI Express, FastAPI, Spring, Rails, Go, NestJS. Evlio infers paths, methods, params, and response shapes from the code, then writes OpenAPI 3.1 you can commit. Finds what nobody remembers Internal admin routes, debug handlers, forgotten v1 endpoints still serving traffic. They show up in the catalog with an owner and a score, not in an incident. Many repos, one catalog Microservices land in one place with consistent naming, so nobody has to guess whether payments lives in two services or five. 02 Organization Grouped, labeled, and searchable in one pass 214 endpoints in a flat list is not a catalog. Evlio labels each one by domain, auth requirement, and data sensitivity, then groups them into collections your team already thinks in. Endpoints 214 total All PII No auth Unused Search endpoints METHOD PATH COLLECTION LABELS CONSUMERS SCORE POST /internal/debug/replay Internal tooling no auth internal none F · 22% GET /billing/legacy/invoices Legacy Billing spec generated PII 1 service D · 54% GET /orders Orders unpaginated high traffic 9 callers C · 68% DELETE /builds/{id} Internal tooling breaking change 2 services C · 71% GET /users/{id}/profile Identity & Auth PII OAuth2 6 callers B · 84% POST /webhooks/stripe Webhooks no auth signature only external B · 80% GET /v1/payments/{id} Payments deprecated duplicate 1 partner B · 82% GET /payments/{id} Payments agent-ready typed 12 callers A · 92% showing 8 of 214 · sorted by score, weakest first labels applied automatically, editable 03 Consumption Know who calls what before you change it Evlio traces each endpoint to the frontend pages, services, and MCP clients that call it, and flags the ones nobody calls at all. Deprecation stops being a guessing game. Who’s consuming Frontend pages 14 Internal services 23 MCP clients 14 Unused endpoints 31 GET /payments/ {id} · callers traced from code and gateway traffic web/checkout/receipt.tsx frontend page · 3 call sites high traffic svc-reconciliation internal service · nightly batch owner: platform Claude Desktop MCP client · get_payment_status 412 calls today ! GET /v1/payments/ {id} deprecated twin · still 40 calls/day from a partner Change this endpoint and Evlio knows exactly whose build breaks, which is what makes a contract enforceable. 04 Scoring A grade per endpoint, and the fix to raise it Design, developer experience, AI readiness, security, and performance, scored per endpoint. Weak specs float to the top of the catalog with a concrete fix attached, so the work is obvious. Your API results by category Scores per 12 API collections 100% 75% 50% 25% 0 Design 92% Developer experience 84% AI readiness 71% Security 64% Performance 59% Weakest endpoints, with the fix ✦ Fix all with AI GET /billing/legacy/invoices D · 54% No description, 6 untyped response fields, auth undocumented Fix: write description, type fields from code, document bearer auth POST /internal/debug/replay F · 22% No auth defined, reachable in production, no consumers found Fix: mark internal, require scope, or retire it GET /orders C · 68% Unpaginated list, 4,100 tokens per agent call Fix: add cursor pagination and a default limit catalog average C · 73% → A · 91% Always current A catalog nobody has to maintain by hand The reason API docs rot is that updating them is a second job. Evlio keeps the catalog in sync with the only thing that is always true: the code. Rescan on every commit New endpoint merged at 4pm, in the catalog by 4:01 with a score and a suggested collection. Auto changelog Every added, changed, and removed endpoint is recorded with the commit behind it, breaking changes flagged. Export anywhere OpenAPI 3.1, Postman collections, SDKs, docs sites, or an MCP server. The catalog is the source, not a dead end. FAQ How does Evlio discover APIs without a spec? It reads the repo in three passes: fingerprinting the frameworks in play, walking every route registration it can prove reachable, and recovering schemas from validators and serializers. The result is an OpenAPI 3.1 document generated from the code itself. Which frameworks does Evlio support? Express, NestJS, FastAPI, Flask, Spring, Go routers (net/http, chi, gin), Rails, and more. Monorepos activate multiple extractors at once; the average repo activates 2.3. How does the catalog stay current? By rescanning the repo: manually on Free, weekly on Startup, and on every commit on Business and Enterprise. The catalog cannot drift from the code because it is derived from the code. From top startups to Fortune 500 companies, trusting Evlio SOC 2 Type II · certified ISO 27001 / 27701 · certified GDPR · compliant Encryption · TLS 1.3 / AES-256 SSO / SAML and SCIM · available Full security posture → RELATED READING Engineering Jul 2 · 11 min How Evlio reads a repo: from route handlers to OpenAPI 3.1 Read → Product May 8 · 5 min Why “no spec” can’t mean “no catalog” Read → Engineering Jun 5 · 9 min Scoring agent readiness: what the A–E grade actually measures Read → See your whole API surface in 42 seconds Connect one repo. No spec file, no config, no credit card. Connect a repo See plans