Catch breaking API changes before your users do

Diffsurge is a developer infrastructure tool that acts as a safety net between your staging and production environments. It works in three stages: First, the CLI detects breaking changes in your API schemas (OpenAPI, GraphQL, gRPC) during CI. Second, a lightweight reverse proxy captures a sample of your production traffic. Third, the replay engine fires that traffic at your staging build and compares every response, surfacing any drift before you deploy.

Diffsurge catches static schema issues — removed required fields, type changes (string → number), deleted endpoints, new required parameters — as well as runtime differences like changed response shapes, missing fields in JSON bodies, status code mismatches, and latency regressions. The diff engine uses semantic comparison, so it ignores cosmetic differences like whitespace or field ordering.

The proxy adds less than 5 ms of latency at p95. It uses an async capture pipeline — request/response pairs are written to a buffered channel and processed by a background worker pool, so the forwarding path is never blocked by storage I/O. You can also configure the sampling rate (e.g., capture 10% of traffic) to reduce overhead further.

Yes. The proxy includes automatic PII redaction that runs before any data is stored. It detects and masks email addresses, phone numbers, credit card numbers, and SSNs using configurable regex patterns. On the Enterprise plan, you can define custom detection rules for domain-specific sensitive fields.

Absolutely. The CLI is a single binary that runs on macOS, Linux, and Windows. Add `surge schema diff --fail-on-breaking` to your GitHub Actions, GitLab CI, Jenkins, or CircleCI workflow. It returns exit code 0 for no changes, 1 for breaking changes, and 2 for errors — so your pipeline blocks automatically when a breaking change is detected.

Diffsurge supports OpenAPI 3.0 and 3.1 (Swagger), GraphQL SDL, gRPC Protocol Buffers, and raw JSON schemas. The diff engine normalises paths and types across formats, so you get consistent breaking-change detection regardless of your API technology.

Load testing checks if your system handles volume. Replay testing checks if your system returns correct responses. Diffsurge replays real production traffic — with real data shapes, edge cases, and parameter combinations — against your staging build and semantically compares every response. It finds the bugs that unit tests and synthetic test suites miss.

The CLI and schema diffing engine are open source under the MIT licence. The traffic proxy, replay engine, and dashboard are available on the Pro and Enterprise plans. You can self-host the entire stack or use our managed service.