Run a complete API reconstruction on your computer

One workflow in every format

Start the local Bun server, then run the Python client, TypeScript client or Postman collection. Each client logs in, rotates the refresh token, encrypts a lookup with AES-256-GCM, signs the exact body with HMAC-SHA-256 and parses the response.

The tests also send a bad signature and require a structured HTTP 403 response. This checks success and failure through the same request path.

bun server.ts
python3 client.py
bun client.ts

Inspect every file

• Synthetic Bun API server
• Python client
• TypeScript client
• Postman collection
• Setup and test notes

What this proves

The package proves that the published formats complete the same session and request flow. It also proves that the Python and TypeScript clients can produce requests accepted by one fixture and reject the same bad signature.

What changes for a real APK

The endpoints, schemas, key source, signed bytes, encryption and session rules come from the APK under review. Tests compare those recovered rules with the running app. Hardware-backed keys and server integrity checks are identified before the quote because copied code cannot export a non-exportable key.

The delivered clients run in your own server, worker, script or internal system. Python, JavaScript/TypeScript, Postman and API documentation cover the same full endpoint set.