# Checkout retry
## 1. `POST` `/v1/orders`
Request body:
card_number: "${REDACTED_CARD}"
Response: **201**
Extracted: `${order_id}`
## 2. `GET` `/v1/orders/${order_id}`
Response: **200**
# Checkout retry
## 1. POST /v1/orders
card_number: ${REDACTED_CARD}
Response: 201
Extracted: ${order_id}
## 2. GET /v1/orders/${order_id}
Response: 200
Turn an API flow into a patch worth reviewing.
Capture a real, ordered request scenario from the client you already use. Secrets stay out. Context lands in Git.
cargo install --git https://github.com/B-Divyesh/sf-api-scenario-patch api-scenario-patch
Free, open source, no account. Rust 1.82+.
The contract
It records less on purpose.
Authorization, cookies, and bodies start denied. A reviewed config names the few paths worth preserving; JSON-path rules redact before the patch touches disk.
- Loopback onlyThe proxy refuses public listeners.
- Deterministic outputNo timestamps or machine-specific paths.
- Replay stays offConfig and command line must both opt in.
One narrow job
Keep your client. Add a review trail.
-
1
Declare the safe slice
asp initcreates a default-deny policy. Allow body routes, redactions, and named extractions explicitly. -
2
Run the existing flow
Point curl, Bruno, Postman, or application traffic at the local reverse proxy. No request editor to relearn.
-
3
Commit two plain files
YAML preserves structure; Markdown gives reviewers a readable change narrative with notes and variables.
Local recorded demo
Watch the secret disappear.
This browser-only example mirrors the CLI transform. It makes no network request and stores nothing.
Run the example to redact a card value and carry ${order_id} into step two.
Cutting the scenario into safe layers…
Made for the pull request
Enough evidence to discuss the flow. Not enough to leak it.
− Paste curl in Slack?
+ Step 2 reuses ${order_id}
+ Observed response: 409 Conflict
+ Reviewer note: retry is intentional
Your next API review
Leave the workspace out of it.
asp init && asp record --output checkout-flow