Taho: API Tester & Security

Test APIs and detect security vulnerabilities instantly — right from your mobile device. Taho is a developer-first, privacy-focused API diagnostic and testing workbench engineered for backend engineers, mobile developers, QA testers, security researchers, and students. With full support for 15 HTTP methods, WebSockets, MQTT, GraphQL, automated collection runs, and on-device OWASP security grading, Taho gives you desktop-grade power on the go.

Core Features:
• 15 HTTP Methods: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS, COPY, LINK, UNLINK, PURGE, LOCK, UNLOCK, PROPFIND, VIEW.
• Real-time Protocols: WebSocket console with live hex-dumped frames + MQTT console with QoS and Last-Will & Testament.
• GraphQL Engine: Query/mutation editor with variables, live WebSocket subscriptions (graphql-transport-ws), and schema introspection documentation explorer.
• SOAP & WSDL: Instant WSDL XML import and auto-generated SOAP 1.1/1.2 envelopes.
• Full OAuth 2.1 & PKCE: Authorization code flow with PKCE-S256, Client Credentials, Bearer tokens, Basic auth, and automatic token refresh.

On-Device Security Audit:
• OWASP Security Grading: Instant A–F security grading with 0–100 posture scoring on every response.
• Automated Vulnerability Checks: HSTS, CSP, X-Frame-Options (Clickjacking), nosniff, Referrer-Policy, and cookie security flags (Secure, HttpOnly, SameSite).
• JWT Decoder & Inspector: Decodes algorithm, header, payload claims, and validates expiration status in real-time.
• Executive PDF Reports: Generate and export branded security audit reports in one tap.

Automation & Developer Tooling:
• Automated Collection Runner: Execute multi-step chained requests with variable passing and CSV data-driven testing.
• JavaScript Sandbox (pm.*): Pre and post-request JS scripting to sign payloads, compute nonces, and set variables.
• Scheduled Background Monitors: Android WorkManager background health checks that survive app termination with transition-only push alerts.
• Local Mock / Replay Server: Run an embedded HTTP mock server on your device to simulate API contracts for offline frontend work.
• Environment Vault: Dynamic {{variable}} autocomplete with OS KeyStore-backed encryption for secrets and API keys.
• Response Diffing & JSONPath: Side-by-side response diffing, interactive JSONPath query evaluator, and collapsible isolate-driven JSON tree viewer.
• Importers & Exporters: One-tap import from cURL, Postman Collections (v2/v2.1), OpenAPI/Swagger 3.0, HAR 1.2, and full .taho backups.

Privacy-First by Design:
• No Ad Trackers: Zero advertising SDKs, zero data brokers.
• Local-First Storage: Your API endpoints, credentials, and test history are stored locally on your device with hardware-backed Android Keystore encryption for sensitive secrets.
• Subscriptions Managed via Google Play: Pro subscriptions are securely processed through Google Play Billing and RevenueCat.
• Governed by the Laws of India.

Engineered for on-call production debugging, microservice testing, and on-device API security verification.