stoplightio/prism

Turn any OpenAPI2/3 and Postman Collection file into an API server with mocking, transformations and validations.

Summary

Prism is an open-source HTTP server that turns an OpenAPI v2/v3 or Postman Collection document into a working mock API or contract-testing proxy. Written in TypeScript and distributed as the @stoplight/prism-cli package, it lets teams exercise API behavior before the backend exists or verify that a running service matches its specification.

What it is useful for

Prism fills two related gaps in API workflows.

1. Mocking when no backend exists. Frontend, QA, or partner teams can hit a real HTTP endpoint backed by your spec instead of waiting for an implementation. The README documents support for OpenAPI v3.1, OpenAPI v3.0, OpenAPI v2.0 (Swagger), and Postman Collections, with content negotiation and security validation included.
2. Contract testing against a real server. The prism proxy command forwards live HTTP traffic to a target service and checks each request and response against the spec, surfacing drift between the documented contract and what the implementation actually does.

Because it runs as a plain CLI process, it also fits into continuous-integration pipelines as a stand-in backend or a sidecar checker.

How engineers can use it

Setup requires Node.js (>= 18.20.1; for the 18.x line, >= 18.16 is required). Install the CLI globally:

npm install -g @stoplight/prism-cli

Start a mock server from a remote spec:

prism mock https://raw.githack.com/OAI/OpenAPI-Specification/master/examples/v3.0/petstore-expanded.yaml

The server then responds on a local port using example data derived from the schema, so you can call it with curl or any HTTP client.

Run a validation proxy in front of an existing service:

prism proxy examples/petstore.oas2.yaml https://petstore.swagger.io/v2

Traffic to the proxy is forwarded upstream, and Prism reports any request or response that does not match the spec.

Documented limitations to keep in mind:

• Inside Docker, the mock binds to localhost by default; you must pass -h 0.0.0.0 to reach it from the host.
• Prism treats OAS2 host + basePath the same as OAS3 server.url, so a v2 spec with a basePath of api/v1 and a paths entry of hello will only respond to http://localhost:4010/hello — http://localhost:4010/api/v1/hello returns 404.
• Recording/Learning Mode and persisted mock data are listed as roadmap items, not implemented features.

For managed use, Stoplight also offers hosted mock servers through Stoplight Platform and Stoplight Studio; the self-hosted CLI above is the path covered in the README.