Every API takes the same road to production. You design it, you mock it while the backend catches up, you test it, you chain a few calls into a real scenario, you put it under load, and eventually you gate a deploy on all of that passing. It's a well-understood lifecycle.
What's strange is how fragmented the tooling for it has become. One app to send requests. A different tool to design the spec. Something else to mock. A separate load tester. A pile of CI scripts to glue it together. Half of them want a cloud account, sync your work to someone else's server by default, and ship a full browser engine just to make an HTTP call.
Atrahasis takes the opposite bet: one fast, native desktop app that covers the entire lifecycle — and stays out of your way. It's built with Tauri and Rust, it's local-first, and its guiding principle (what the team calls the Atrahasis Code) is flexibility. Every part works on its own, works together, or works alongside the tools you already use. Nothing is strict. Nothing is locked in.
Here's a walk through what that actually means, step by step.
The client: every protocol you actually use
It starts where every API tool starts — sending requests. Atrahasis speaks HTTP/REST, WebSocket, GraphQL, and Server-Sent Events (SSE), so you're not switching tools when your stack moves past plain REST.
This isn't a thin wrapper over a generic HTTP library. The networking layer is a custom Rust stack built on hyper, rustls, and tokio, which buys you precise control over connection reuse, TLS, and per-phase timing. You can inspect exactly where time goes in a request — DNS lookup, TCP handshake, TLS negotiation, time-to-first-byte — down to the microsecond. Authentication is first-class too: Basic, Bearer, API Key, full OAuth 2.0, and OIDC, with token auto-refresh.
It's the kind of client you can live in all day. But sending requests is just the first step on the road.
Visual assertions: testing without writing test scripts
The moment you send a request more than once, you start caring whether the response is correct, not just whether it came back. Atrahasis lets you assert that visually — no scripting required.
Point and click to check status codes, response times, headers, and body content. Go deeper with JSON Path expressions like $.id, $.data[0].name, or $.items[*].price, combined with operators like equals, contains, exists, and regex. Each assertion shows pass/fail instantly after every request — no separate "test run" step.
Need structural guarantees? Bring your own JSON Schema (no OpenAPI required) and validate the whole response shape against it. That's contract validation built right into the request panel, so breaking changes get caught before they reach production. Assertions and contracts can run together.
Debugging: see exactly what happened
When a request misbehaves, "it returned 500" is rarely enough. Atrahasis gives you the full picture of every call: a timing waterfall that breaks the request into DNS, TCP, TLS, and time-to-first-byte phases; the actual TLS certificate the server presented; and every header and cookie that went out and came back. Instead of guessing whether the problem is your payload, the network, or the server, you can look at the exact stage where things went wrong. It turns debugging from speculation into observation.
Projects and the OpenAPI designer: your project is the spec
This is where Atrahasis goes further than most clients. Its OpenAPI designer treats your project and your spec as the same thing, bi-directionally synced: edit the YAML and the project updates; edit the project and the YAML updates. Conflict resolution is built in — source-wins, target-wins, deep-merge, or ask. No drift.
It's version-fluent across Swagger 2.0, OpenAPI 3.0, 3.1, and 3.2 — 2.0 auto-upgrades, 3.0 ↔ 3.1 converts both directions, and the spec that leaves the designer is pure, portable OpenAPI that works in any other tool. You design visually or in a code editor with live preview, hit Try It Out to fire real requests straight from the spec, and validate against the contract as you go. No vendor lock-in, ever — your specs are yours.
Flow Runner: chaining requests into real scenarios
A single request rarely tells the whole story. Real usage is "log in, grab a token, create a resource, read it back, delete it." The Flow Runner turns that into an automated workflow with a visual, step-by-step builder.
Chain multiple requests, extract variables from one response to feed into the next, attach assertions to any step, configure retries, and run iterations — sequentially or in parallel. Each run produces detailed execution analytics so you can see exactly which step failed and why. Pre- and post-scripts give you an escape hatch when you need real logic: scoped namespaces (at.environment, at.flow, at.request, at.response, at.export) let you read and mutate state without leaving the flow.
Load testing: put the API under real pressure
Once a flow works, you want to know what happens when a thousand of them hit at once. Atrahasis ships five built-in traffic shapes — Load, Stress, Spike, Soak, and Custom — each with its own virtual-user profile, ramp, and duration.
You get live percentile metrics (not just averages, which lie), threshold gates that define pass/fail, and run comparison so you can see whether last week's optimization actually helped. The results are CI-ready, which matters for the last step.
Mock server: a live API in seconds
Frontend teams shouldn't have to wait for the backend, and you shouldn't have to spin up infrastructure to fake a response. Atrahasis has a built-in mock server — no Docker, no separate Node process, no config files. Pick a port, hit Start, and you have a live API.
You author mocks the same way you author real endpoints, so there's nothing new to learn. Stack multiple response variants on one endpoint — success, validation error, unauthorized, timeout — and let rule-based matching decide which one fires based on query params, headers, or body. Edit endpoints while the server is running; changes are live on the next request and in-flight calls never break. Add latency simulation and dynamic responses and your mock starts behaving like the real thing.
Reporting: the run ends, the report is ready
A test that nobody sees the results of isn't very useful. Every Flow Runner and Load Test result becomes a shareable artifact in three formats: an HTML dashboard, a PDF archive, or an OpenTelemetry JSON feed — one click from the results panel.
Or automate it: from an After All script, at.export.json(), .html(), and .pdf() return a ready-to-send report in a single call. Pipe it to Slack, email, S3, a CI artifact store, or your observability stack — wherever fetch reaches, no glue code required. Every metric you saw in the app lands in the report: percentile latencies, per-step breakdowns, error analysis, nothing stripped.
CI/CD: the same work, gating your deploys
Here's the payoff. Every flow, load test, and assertion you built in the desktop app runs unchanged in your pipeline via the atra CLI — a native binary with zero runtime dependencies, native HTTP/3 support, and a live terminal dashboard.
The model is clean:
-
Exit code is your deploy gate. Every assertion and threshold rolls up into one exit code —
0ships,1blocks. No log scraping, no custom pass/fail scripts. -
Install-free.
npx --yes @atrahasis/cliruns in any Node-capable runner — no setup step, no cache warmup. - Secrets from the shell. Credentials come from your CI platform's own secret store; flow and spec files stay git-safe.
-
Reports as artifacts. The same
After Allexport ships HTML/PDF/JSON to wherever your team looks.
And it's genuinely portable — GitHub Actions, GitLab CI, Jenkins, CircleCI, Azure Pipelines, Bitbucket, Drone, Buildkite, TeamCity. atra has no platform-specific integration because it doesn't need one: it's a standard command-line tool.
Local-first, by design
Tying it all together is a quiet but important choice: your work stays on your machine. Environments give you one variable name per stage (dev, test, stage, prod) and switch with a toggle. Secrets can go straight to the OS keychain — macOS Keychain, Windows Credential Manager, Linux Secret Service — or pull fresh from HashiCorp Vault at request time. Nothing sensitive hits disk, nothing leaks into git.
There's also a full Git integration built in, which is what makes the whole lifecycle portable. You author flows and load-test specs in the app and commit them as plain .flow.json / .spec.json files — versioned, reviewable in a pull request, and runnable by the CLI in CI. Your API tests live in the same repo as your code, move with it, and get the same review your code does.
Because it's a native Tauri + Rust app using the system webview instead of bundling Chromium, it stays small and starts fast. And because it's local-first, there's no account wall between you and your first request.
Where to start
Atrahasis SE is free forever. Pro adds the advanced lifecycle features (including exporting flows and load-test specs for CI) with a 30-day trial. It runs on macOS, Windows (now on the Microsoft Store), and Linux.
The pitch is simple: the API lifecycle is one road. Your tooling should be able to travel the whole thing — design, mock, test, scenarios, load test, CI/CD — without forcing you to stitch five products together or hand your work to the cloud. Use one piece, use all of it, or slot it in next to what you already have.
Links:
Platform: Atrahasis
CLI: Atrahasis CLI
Download: Download Atrahasis
