auto-detect-route

Auto-discover your Express.js routes and test them in the browser — zero config, no Postman needed.

Mount one route, visit it in any browser, and get a full API explorer UI with a sidebar, request builder, and response viewer.

Current support: Node.js + Express.js Support for Fastify, Koa, Hapi, NestJS, and other frameworks is coming soon.

Requirements

• Runtime: Node.js >= 16.0.0
• Framework: Express.js v4 or v5

This package is purpose-built for Node.js + Express.js projects. Other framework packages will be published separately as they become available.

Install

Install as a dev dependency — it is a development tool and should never run in production.

npm install --save-dev auto-detect-route

Usage

JavaScript

const express = require('express');

const app = express();

// Mount only in development
if (process.env.NODE_ENV !== 'production') {
  const { autoDetectRoute } = require('auto-detect-route');
  app.use('/api-explorer', autoDetectRoute());
}

app.listen(3000, () => {
  console.log('Open http://localhost:3000/api-explorer');
});

TypeScript

import express from 'express';

const app = express();

// Mount only in development
if (process.env.NODE_ENV !== 'production') {
  const { autoDetectRoute } = require('auto-detect-route') as typeof import('auto-detect-route');
  app.use('/api-explorer', autoDetectRoute({
    rootDir: __dirname,
    baseUrl: 'http://localhost:3000',
    title: 'My API Explorer',
  }) as any);
}

app.listen(3000);

Using require() inside the if block ensures the package is never loaded in production, even if it is accidentally present in node_modules.

Visit http://localhost:3000/api-explorer in your browser — that's it.

What you get

• Sidebar — all your Express routes auto-detected, grouped by file or HTTP method
• Request builder — path params, query params, headers (with bearer token shortcut), JSON body editor
• Body pre-fill — req.body fields are detected from your route handlers and pre-populated automatically
• Response viewer — syntax-highlighted JSON, raw text, response headers, status code, timing, size
• Variables — {{VAR_NAME}} placeholders in any field, BASE_URL pre-configured automatically
• Filter & rescan — live filter routes, rescan without restarting the server
• State persistence — your inputs are saved per-route in localStorage

Options

autoDetectRoute({
  rootDir: __dirname,               // Directory to scan (default: process.cwd())
  baseUrl: 'http://localhost:3000', // Default base URL shown in the UI
  exclude: ['tests', 'mocks'],      // Extra glob patterns to exclude from scanning
  title: 'My API Explorer',         // Browser tab / header title
})

| Option | Type | Default | Description | |-----------|------------|-------------------------|--------------------------------------------------| | rootDir | string | process.cwd() | Root directory to scan for Express routes | | baseUrl | string | http://localhost:3000 | Default base URL (seeds the BASE_URL variable) | | exclude | string[] | [] | Extra glob patterns to skip during scanning | | title | string | Auto Detect Route | Page title shown in the browser tab and header |

TypeScript support

Full type definitions are included — no @types/ package needed.

import type { AutoDetectRouteOptions, DetectedRoute, RouteParam, HttpMethod } from 'auto-detect-route';

const options: AutoDetectRouteOptions = {
  rootDir: __dirname,
  baseUrl: 'http://localhost:3000',
  exclude: ['tests'],
  title: 'My API Explorer',
};

Using with tsconfig.json

No special configuration is needed. The package ships compiled JS with .d.ts declaration files.

{
  "compilerOptions": {
    "skipLibCheck": true
  }
}

If you're on Express 5 (@types/express@^5), add as any when mounting since the package's Router type is built against Express 4. This is a type-only issue and does not affect runtime behaviour.

How it works

The middleware uses AST parsing (via @typescript-eslint/typescript-estree) to scan your JS/TS files and detect Express routes — including nested routers, app.use() mounts, chained .route() calls, and named controller handlers.

It follows require()/import chains cross-file, so body fields are detected even when handlers are in separate controller files:

// routes/users.js
router.post('/users', userController.createUser);   // ← follows this reference

// controllers/userController.js
exports.createUser = (req, res) => {
  const { name, email, role } = req.body;           // ← detects these fields
};

HTTP requests are proxied through your server, so there are no CORS issues when hitting APIs on any origin.

Supported route patterns

// Basic
app.get('/users', handler)
router.post('/users', handler)

// Named controller handlers (body fields auto-detected cross-file)
router.post('/users', userController.createUser)
router.post('/auth/signup', authController.signup)

// With prefix mount
app.use('/api', userRoutes)
app.use('/api', require('./routes/users'))

// Chained
router.route('/users/:id').get(h).put(h).delete(h)

Security

This package is intended for local development only.

• Mount it inside a NODE_ENV !== 'production' guard (see Usage above)
• Sensitive files (.env, .key, .pem, credentials, SSH keys) are never read by the scanner
• Only http: and https: protocols are allowed in the proxy
• Response bodies are capped at 10 MB
• Do not expose the /api-explorer route on a public-facing server

Coming soon

Support for other Node.js frameworks will be published as separate packages:

• auto-detect-route-fastify
• auto-detect-route-koa
• auto-detect-route-hapi
• auto-detect-route-nest

License

MIT