Detect response drift
before users do.
Behavior profiling runs authenticated checks against your REST API every day, compares responses to baseline, and alerts you when payloads, status codes, latency, or exposed data drift.
Endpoint
GET /orders
200 status, 1.2 KB response, 180ms latency
Thursday scan
Drift detected
Response size 1.2 KB → 8.4 KB
Alert
Debug object introduced in payload
Thursday and Friday exceed baseline due to a response drift event with field-level changes captured for review.
01 / What Counts as Drift
Five ways responses change.
Only some of them are safe.
JSON body
Field added, removed, renamed, or type-changed
Breaking change for downstream integrations
Status code
200 becomes 401, 403, or 500
Auth regression or unhandled error path
Response size
Payload grows from 1.2 KB to 8.4 KB
Debug data or unintended object serialization in production
Response time
Latency increases from 180ms to 2,400ms
Backend degradation before users notice
Sensitive data
PII, API keys, or tokens appear in response body
Data exposure requiring immediate remediation
02 / Workflow
How drift detection works.
Every 24 hours.
Import your OpenAPI spec
ApyGuard reads endpoint definitions, parameter schemas, and expected response structures to establish what normal looks like.
Configure credentials
Provide API keys or auth tokens for authenticated coverage so daily checks validate real production-facing flows.
Run daily scans
ApyGuard replays authenticated requests against covered endpoints and records body, status code, size, and latency.
Detect and review drift
Every response is compared to baseline. Deviations become alerts with response diffs your team can inspect immediately.
Approve intended changes
Expected updates can be acknowledged to establish a new baseline while accidental drift stays in the remediation queue.
03 / Sensitive Data Detection
Detect response changes
that expose data.
Behavior profiling looks beyond schema drift and watches for newly exposed data patterns such as PII, secrets, or financial fields appearing in responses unexpectedly.
PII
Email addresses, phone numbers, full names, dates of birth
Financial data
Credit card numbers, bank account numbers
Auth credentials
API keys, session tokens, JWT secrets, plaintext passwords
Identity data
National ID numbers, passport numbers
FAQ
Before you put drift detection
on a schedule.
How does the baseline get established?
The first scan establishes the response baseline for each endpoint. Every later run compares against that saved state.
What do I do when I intentionally update an endpoint?
Dismiss the expected drift alert and confirm the baseline update so future scans compare against the new intended response.
Does ApyGuard store my API credentials?
Credentials are encrypted at rest and used only to execute the authenticated validation requests.
Does it work with GraphQL or gRPC?
No. Behavior profiling currently supports REST APIs with OpenAPI specifications.
API Behavior Profiling
Know when responses change
before integrations break.
Baseline your authenticated endpoints, then let ApyGuard alert you the moment production behavior drifts.