API Flow
Every integration crossing your repository's boundary, on one diagram. The Code Map's Routes panel lists your endpoints; the Data Flow panel on the Dashboard knows input arrives. Neither shows the outbound half, and neither shows the data on either side of a call — that is what API Flow is for.
How it works
The scan reads your source for HTTP calls in both directions and draws four kinds of node:
- Inbound from — a client or an external service calling into your application.
- Our endpoint — a route your application exposes.
- Our module — internal code between an endpoint and an outbound call.
- Outbound to — a service your code calls out to.
The tab
Reading the legend
The rule across the top of each card carries the meaning, and the legend at the bottom of the canvas names all five states:
- Grey — inbound from a client the scan cannot further classify.
#0079B6— one of our own endpoints.- Dark — an internal module sitting between an endpoint and an outbound call.
#008446— an outbound call to an external service.- Dashed red — the call target is built at runtime rather than a literal URL, so the scan could not resolve which service it reaches.
The call inspector
Click any node to open its detail panel. For each call it lists the payload out and the payload back — never the file path or line number, so the payloads stay above the fold even on a component with several calls. Wording follows the direction from your repository's point of view: on your own endpoint, a request is received and a response is sent; on an outbound call, a request is sent and a response is received.
Each payload block is a field tree with its type, marked optional where relevant. A response payload the scan could not observe directly is marked assumed — Mapnostics's own belief about what the other side returns, not a captured fact.
What it cannot see
- A call built from a runtime value has no literal URL to resolve, so it is drawn as an unproven edge rather than guessed at.
- The diagram is static analysis. It shows what your code can call, not what actually ran in production.
- Middleware order and execution timing are not shown — an arrow is a call, not a sequence.