Turn any website into an API, even one that never had one.
Plenty of systems worth integrating with were never built for it: no REST API, no webhook, just a browser UI. QA Reef records a flow the way a person performs it and exposes it as a real HTTP endpoint (GET /<site>/<method>) callable like any other service.
How it works
Every site QA Reef knows is a small class with public methods: login(), search(query), fetchDocument(id). src/api.js is a dependency-free HTTP facade: one warm browser instance per site, calls queued so they don't collide, every public method auto-becomes a route. Underneath, network traffic is captured per call (HAR plus artifact validation), so a fetched file is the real bytes off the wire, checked by its magic bytes, not a screenshot of one.
This is real code in the repo today, not a mockup:
GET /countyportal/search?q=123+Main+St
POST /erp/fetchInvoice { "id": "INV-4482" }
GET /pdfviewer/fetchDocument?id=abc123
→ { "ok": true, "result": { ... } }Three concrete examples
A county records portal, as an API
A public records site with a search form and viewer: no API, no bulk export. Wrapped as a QA Reef site: GET /countyrecords/search and /fetchDocument return JSON, callable from a script or cron job.
An old ERP with frames, as an API
Frame-era internal systems often hold data another tool needs (invoice status, shipment record) behind a UI with no export or API. A QA Reef site class that navigates the frameset turns fetchInvoice(id) into a plain function call.
A PDF-viewer document fetch, as an API
An in-browser document viewer isn't reachable by a normal HTTP request: you can't curl it. A QA Reef flow that opens it, reads the toolbar by OCR, and clicks "download" turns that into GET /viewer/fetchDocument?id=..., same interface as a real API. The file itself is captured off the network and validated by its magic bytes, so an error page saved with a .pdf name never passes as a document.
What we won't do
- No CAPTCHA solving on sites you don't control: on an app you own or are authorized to test, QA Reef handles the challenge with vendor test keys, a bypass token, session reuse, or a solver you configure, all gated on your attestation; anywhere else it reports what it saw and stops.
- Respect terms of service and robots rules: infrastructure for sites you're authorized to operate.
- Record-and-stop on walls, not guess past them: an unexpected auth screen or error page returns an honest UNMEASURED result, not a fabricated success.
The same recorded flow runs four ways
QA is the entry point, not the ceiling. Nothing is re-recorded to switch mode.
Test
Deploy it, fan it out, file the bug. Runs →
Data entry
Once per spreadsheet row, with evidence per row. Bulk data entry →
Scrape
On a schedule, durable and auditable. Long-running scraping →
API
A site with no API gets one. Website → API →
Read the technique in detail
OCR words to coordinates, curved mouse movement, evidence per step, and what happens when a 2004-era portal just never settles.
Read: Making an API out of a 2004 web portal →