semapi Self Maintaining APIs & Tooling

Stop finding out
in production.

− Third-party APIs change. You find out from a support ticket. + Third-party APIs change. You get a fix.

Semapi watches the third-party endpoints your code depends on. When one changes, it tells you what changed and where it hits your code.

Book a demo
Changelog
Illustrative

A changelog for everything you depend on but don't control.

ProviderChangeResult
Microsoft Graphdrive item permissions: grantedTo → grantedToV2FIX
KarpenterNodePool apiVersion: v1beta1 → v1FIX
Prometheus exporterA metric was renamed. 3 alert rules still query the old name.ALERT
DatadogA monitor query uses a parameter that is now deprecated.ALERT
The problem

Your app fetches which files a user can access through Microsoft Graph. One day the provider renames a field, requires a new key, or reshapes a response. Nothing in your repo changed. The feature is broken anyway, and the first alert is a customer.

What it is

Your dependencies change without warning. Semapi hears it first.

Code reviewers read the changes you make. Semapi listens for the changes you don't make: the ones your providers publish, which can take your application down without a single commit on your side.

Code reviewersSemapi
Looks atThe code you writeThe APIs and tools you depend on
Reacts toYour pull requestsChanges your providers publish
CatchesBugs in your changesBreakage that arrives with no change in your repo
ProtectsCode qualityYour customers' availability
How it works

From vendor changelog to your repo.

01 We watch official sources.Changelogs, specs and release notes, straight from vendors.
02 We turn changes into structured records.Each change gets a risk score and a link to the original source.
03 We match only what you use.We compare changes against the endpoints, charts and resources your code actually depends on. If you only list and download Drive files, you never hear about folder creation.
04 You get an alert or a ready-made fix.It opens in your repo and is tested by your own CI. Nothing merges without your review.
Your code

Your code stays with you.

Two ways to let Semapi learn what your code uses. You choose.

Your own CI Default.Run the scanner in your own CI pipeline. It sends us only a short list of what your code uses. Your code never leaves your environment.
Read access Zero setup.Give Semapi read permission on your repo. We scan the code in an isolated EU sandbox and delete it when the scan ends.
Example · usage manifest
semapi-usage.json
1{
2 "repo": "acme/billing-service",
3 "uses": [
4 "google.drive.files.list",
5 "karpenter helm chart 0.37.0"
6 ]
7}
Names and versions only. No source code, secrets or config values.
Where it runs

Runs inside your own GitHub organization.

It is set up once for the whole organization, and it only watches the repositories you choose.

Connect Set it up at the organization level, not repo by repo.
Choose Pick the repositories that depend on third-party services.
Review Fixes arrive as proposals. Your reviewers and CI decide what merges.
Coming soon
GitLabSlack alertsMicrosoft Teams alertsJira
Self Maintaining APIs

Know exactly what changed. Or just merge the fix.

Changes arrive in your normal review flow, so your own checks still decide what ships. All examples on this page are illustrative.

Option A · A raised issue
acme/backend
Upstream change: Microsoft Graph drive item permissions #213
Open semapi opened this issue just now api-drift breaking-change microsoft-graph
s semapi commented just now
Microsoft Graph changed the response of an endpoint your code calls. Your integration still reads the old field, so users with access would be missing from the result.
Risk score
78 / 100
Severity85
Exposure70
Urgency65
Confidence92
EndpointGET /drives/{id}/items/{id}/permissions
ChangegrantedTo is replaced by grantedToV2
Affected codesrc/graph/permissions.ts#L42
DeadlineMar 31, 2027
src/graph/permissions.ts
40 );
41
42 const users = res.value.map((p) => p.grantedTo.user.id);
43
44 return new Set(users);
Suggested fix: read grantedToV2.user.id and handle missing values.
Option B · A ready-made fix
acme/backend
Adapt to Microsoft Graph permissions change
Open semapi opened this pull request just now
s semapi Microsoft Graph now returns grantedToV2. This reads the new field so users with access are not dropped.
Risk score
78 / 100
Severity85
Exposure70
Urgency65
Confidence92
DeadlineMar 31, 2027
src/graph/permissions.ts+1 −1
@@ -38,9 +38,9 @@ export async function getFileAccess(driveId, itemId) {
3838 const res = await graph.get(
3939 `/drives/${driveId}/items/${itemId}/permissions`
4040 );
4141
42− const users = res.value.map((p) => p.grantedTo.user.id);
42+ const users = res.value.flatMap((p) => p.grantedToV2?.user?.id ?? []);
4343
4444 return new Set(users);
4545}
Self Maintaining Tooling

Your infrastructure tools ship breaking changes too.

The same watch-and-fix loop, pointed at the tools you run. Semapi notices when an upstream release changes what your configuration expects, and updates it or tells you.

Manifests and CRDs
API version bumps and renamed fields in your Kubernetes resources.
Helm values and flags
Options that moved, changed defaults or were deprecated.
Terraform providers
Major provider upgrades and the arguments they rename or remove.
Dashboards, monitors and alerts
Queries and rules that depend on something that changed upstream.
Example · Semapi updates a Karpenter NodePool
acme/platform-infra
Move Karpenter NodePool to the v1 API
Open semapi opened this pull request just now
s semapi The v1beta1 NodePool API is replaced by v1. This updates the version and the node class reference.
Risk score
66 / 100
Severity70
Exposure60
Urgency55
Confidence95
DeadlineJun 30, 2027
infra/karpenter/nodepool.yaml+3 −1
@@ -1,11 +1,13 @@
11 # General purpose workloads
2− apiVersion: karpenter.sh/v1beta1
2+ apiVersion: karpenter.sh/v1
33 kind: NodePool
44 metadata:
55 name: default
66 spec:
77 template:
88 spec:
99 nodeClassRef:
10+ group: karpenter.k8s.aws
11+ kind: EC2NodeClass
1012 name: default
1113 requirements:
Example · Semapi upgrades a Terraform provider
acme/platform-infra
Upgrade AWS provider to v6
Open semapi opened this pull request just now
s semapi The version bump and the code migration land together, so this PR passes on the first run. vpc = true on aws_eip becomes domain = "vpc".
Risk score
72 / 100
Severity80
Exposure75
Urgency55
Confidence95
DeadlineDec 31, 2026
CI check✓ terraform plan: No changes
versions.tf+1 −1
@@ -2,7 +2,7 @@ terraform {
22 required_providers {
33 aws = {
44 source = "hashicorp/aws"
5− version = "~> 5.0"
5+ version = "~> 6.0"
66 }
77 }
network.tf+1 −1
@@ -14,5 +14,5 @@
1414resource "aws_eip" "nat" {
15− vpc = true
15+ domain = "vpc"
1616 tags = { Name = "nat" }
1717}
Coverage

What Semapi watches for you.

Three categories at launch.

SaaS APIs
Microsoft GraphGoogle WorkspaceStripeSlackGitHub
Platform tools
KarpenterKEDAKyvernoIstioCiliumcert-managerTerraform providers for AWS, Azure and GCP
Observability
DatadogPrometheus stackGrafanaLoki
Your own internal APIs too.
Point Semapi at your OpenAPI spec and it warns you on your own PR before a change breaks another team's code.
Trust and security

What to know before you connect a repo.

EU-hosted Semapi is an EU-hosted SaaS.
Read-only Read-only by default. Write access is only used to open alerts and fixes.
Reviewed Every fix goes through your CI and your reviewers.
Private Code snippets are never stored or used for training.
Pricing

A platform fee, plus a price per extra repository.

€19
per month, first repository included.
+ €3 per month for each additional repository.
All prices exclude VAT.

Let providers change.
Stay up.

Animated reaction
Are we hitting the right spot?
Book a demo →
© 2026 semapi