\n\nLocal drop-in replacement services for CI and no-network sandboxes. Fully stateful, production-fidelity API emulation. Not mocks.\n\n## Quick Start\n\n```bash\nnpx emulate\n```\n\nAll services listen on IPv4 loopback (`127.0.0.1`) by default. No config file needed:\n\n- **Vercel** on `http://localhost:4000`\n- **GitHub** on `http://localhost:4001`\n- **Google** on `http://localhost:4002`\n- **Slack** on `http://localhost:4003`\n- **Apple** on `http://localhost:4004`\n- **Microsoft** on `http://localhost:4005`\n- **Okta** on `http://localhost:4006`\n- **AWS** on `http://localhost:4007`\n- **Resend** on `http://localhost:4008`\n- **Stripe** on `http://localhost:4009`\n- **MongoDB Atlas** on `http://localhost:4010`\n- **Clerk** on `http://localhost:4011`\n- **Linear** on `http://localhost:4012`\n- **Twilio** on `http://localhost:4013`\n\nStripe webhooks configured with a secret include a `Stripe-Signature` header signed over the timestamp and raw request body.\n\nSlack event callbacks use `X-Slack-Request-Timestamp` and `X-Slack-Signature` when `slack.signing_secret` is configured. The signature is an HMAC-SHA256 over `v0::`; configure the receiver with the same secret and verify against the unparsed request body. Existing event subscriptions remain unsigned when the secret is absent or empty.\n\nResend `POST /emails` and `POST /emails/batch` support 24-hour `Idempotency-Key` replay, returning the original email IDs without duplicate emails or webhooks.\n\n## Custom emulators\n\nBuild and share emulators for the third-party HTTP APIs your app uses. Define a provider's behavior in TypeScript, run it alongside built-in services, and reuse it in tests and framework adapters. emulate provides seeds, resets, persistence, and request/state inspection.\n\nStart from a working scaffold and adapt its routes and state to your provider:\n\n```bash\nnpm install -D emulate\nnpx emulate init --custom inventory\nnpx emulate start --watch\n```\n\nThe scaffold implements reservations, stock changes, cancellation, and out-of-stock errors. It creates a runnable Node test and adds the service to a discovered YAML, JSON, TypeScript, or JavaScript config. For an unusual executable config, it prints the import and service entry to add manually. `init` prints the test command and directs you to the service URL and Inspector link printed by `start`; the port depends on the config. Watch mode retries when a missing local import is created, including outside the config directory. Use the inspector to view requests and state or reset to the initial seed. Structured inspection redacts token and secret fields such as `access_token`, `refresh_token`, and `client_secret`.\n\n```typescript\nimport { defineEmulator, createEmulator } from 'emulate'\n\nconst acme = defineEmulator({\n name: 'acme',\n state: () => ({ anvils: 100 }),\n setup({ app, state }) {\n app.get('/inventory', (c) => c.json(state))\n app.post('/orders', (c) => {\n if (!state.anvils) return c.json({ error: 'sold_out' }, 409)\n state.anvils -= 1\n return c.json({ shipped: 'anvil', to: 'coyote' }, 201)\n })\n },\n})\n\nconst api = await createEmulator({ service: acme, listen: false })\ntry {\n await api.request('/orders', { method: 'POST' })\n const checkpoint = api.snapshot()\n await api.reset()\n await api.restore(checkpoint)\n} finally {\n await api.close()\n}\n```\n\nUse `defineConfig({ services: { acme: { emulator: acme }, github: { emulator: 'github' } } })` in `emulate.config.ts`. YAML/JSON entries accept local module paths and installed packages. `--config` selects a config explicitly; legacy flat configs and `--seed` remain supported. Node loads local TypeScript with path aliases and source locations without additional runtime dependencies. Node 26 supports erasable TypeScript only; compile enums and parameter properties to JavaScript before loading them. Node 24 also supports native TypeScript transforms.\n\nCustom state uses your own record shapes and IDs. Seeds replace the complete initial state. Reset restores the captured seed; successful watch reloads create a new baseline and reset the run. With config auto-discovery, watch mode also detects recognized config files created after startup. Instances are independent. Persistence is opt-in, with versioned snapshots and no cross-process locking. Use `port: 0` for HTTP tests, or `listen: false` to test without opening a port. Custom reset and close are awaitable. Framework adapters keep root-relative custom redirects under the service mount while preserving custom HTML bodies.\n\nStreamed responses persist state changes when their bodies finish or are canceled. Reset and close cancel active streams before running cleanup. `c.header('Set-Cookie', value, { append: true })` retains cookies already set on the response. In a Next.js route, export `OPTIONS` from `createEmulateHandler` to forward preflight requests and custom OPTIONS handlers.\n\nSee the [custom emulator guide](https://emulate.dev/docs/custom-emulators) and [complete inventory example](examples/custom-api) for validation, middleware, persistence, adapters, package sharing, and troubleshooting.\n\n## CLI\n\n```bash\n# Start all services (zero-config)\nnpx emulate\n\n# Start specific services\nnpx emulate --service vercel,github\n\n# Custom port\nnpx emulate --port 3000\n\n# Use a seed config file\nnpx emulate --seed config.yaml\n\n# Generate omitted service secrets into a private file\nnpx emulate start --seed config.yaml --generated-secrets-file .emulate-secrets.json\n\n# Generate a starter config\nnpx emulate init\n\n# Generate config for a specific service\nnpx emulate init --service vercel\n\n# List available services\nnpx emulate list\n```\n\n### Options\n\n| Flag | Default | Description |\n|------|---------|-------------|\n| `-p, --port` | `4000` | Base port (auto-increments per service) |\n| `--host` | `127.0.0.1` | Listening address; use `0.0.0.0` to allow network access |\n| `-s, --service` | all | Comma-separated services to enable |\n| `--seed` | auto-detect | Path to seed config (YAML or JSON) |\n| `--base-url` | none | Override advertised base URL (supports `{service}` template) |\n| `--portless` | off | Serve over HTTPS via portless (auto-registers aliases) |\n| `--generated-secrets-file` | none | Generate omitted service secrets and write them to a new owner-only JSON file |\n\nThe port can also be set via `EMULATE_PORT` or `PORT` environment variables.\n\nFor access from a container or another machine, use `npx emulate start --host 0.0.0.0`. Set `--base-url` to a URL reachable by those clients when using OAuth redirects or other advertised URLs.\n\n## HTTPS with portless\n\n[portless](https://github.com/vercel-labs/portless) gives emulators trusted HTTPS URLs with auto-generated certs and no browser warnings.\n\n```bash\n# Start the portless proxy (first time only)\nportless proxy start\n\n# Start emulate with portless integration\nnpx emulate start --portless\n```\n\nEach service registers as a portless alias and gets a named HTTPS URL:\n\n```\ngithub https://github.emulate.localhost\ngoogle https://google.emulate.localhost\nslack https://slack.emulate.localhost\n```\n\nIf portless is not installed, emulate will prompt to install it (`npm i -g portless`).\n\nThe `--portless` flag overwrites any existing portless aliases matching `*.emulate`. Aliases are removed automatically when emulate shuts down.\n\nFor a custom base URL without portless (any reverse proxy), use `--base-url` or the `EMULATE_BASE_URL` env var:\n\n```bash\nnpx emulate start --base-url \"https://{service}.myproxy.test\"\n```\n\nThe `PORTLESS_URL` env var is automatically set by the `portless` CLI wrapper when running a command through it (e.g. `portless github.emulate emulate start`), typically to a value like `https://{service}.emulate.localhost`. It supports `{service}` interpolation, just like `--base-url` and `EMULATE_BASE_URL`. When no explicit `baseUrl` is provided, it is used as a fallback.\n\nPer-service overrides are also supported in the seed config (these take highest priority over all other base URL sources):\n\n```yaml\ngithub:\n baseUrl: https://github.emulate.localhost\n```\n\n## Programmatic API\n\n```bash\nnpm install emulate\n```\n\nEach call to `createEmulator` starts a single service:\n\n```typescript\nimport { createEmulator } from 'emulate'\n\nconst github = await createEmulator({ service: 'github', port: 4001 })\nconst vercel = await createEmulator({ service: 'vercel', port: 4002 })\n\ngithub.url // 'http://localhost:4001'\nvercel.url // 'http://localhost:4002'\n\nawait github.close()\nawait vercel.close()\n```\n\nWhen a GitHub App omits `private_key`, `createEmulator` generates an RSA-2048 PKCS#1 key for that emulator instance:\n\n```typescript\nconst github = await createEmulator({\n service: 'github',\n seed: {\n github: {\n users: [{ login: 'octocat' }],\n apps: [{\n app_id: 12345,\n slug: 'my-github-app',\n name: 'My GitHub App',\n installations: [{ installation_id: 100, account: 'octocat' }],\n }],\n },\n },\n})\n\nconst privateKey = github.generatedSecrets.find(\n secret => secret.kind === 'github.app_private_key' && secret.id === '12345',\n)?.value\n```\n\nGenerated keys remain stable across `reset()` calls and appear only in `generatedSecrets`. Explicitly configured keys are never returned there. A new `createEmulator` call generates a new key.\n\nThe CLI can also generate omitted GitHub App keys when a delivery file is requested:\n\n```bash\nnpx emulate start --service github --seed config.yaml \\\n --generated-secrets-file .emulate-secrets.json\n```\n\nThe destination must not exist. emulate removes inherited ACLs, verifies effective owner-only access, and publishes complete JSON before opening listeners or configuring portless. Handled startup failures remove the invocation-owned artifact so the command can be retried immediately. A hard termination such as `SIGKILL` can leave a complete published artifact that must be removed manually after confirming no invocation is using it. Only generated secrets are included. Explicitly configured keys are never copied into the artifact. Linux requires `setfacl` and `getfacl` from the `acl` package. The flag fails closed when access controls cannot be verified and is not supported on Windows. Without `--generated-secrets-file`, CLI seed files keep requiring `private_key`.\n\n### Vitest / Jest setup\n\n```typescript\n// vitest.setup.ts\nimport { createEmulator, type Emulator } from 'emulate'\n\nlet github: Emulator\nlet vercel: Emulator\n\nbeforeAll(async () => {\n ;[github, vercel] = await Promise.all([\n createEmulator({ service: 'github', port: 4001 }),\n createEmulator({ service: 'vercel', port: 4002 }),\n ])\n process.env.GITHUB_EMULATOR_URL = github.url\n process.env.VERCEL_EMULATOR_URL = vercel.url\n})\n\nafterEach(() => { github.reset(); vercel.reset() })\nafterAll(() => Promise.all([github.close(), vercel.close()]))\n```\n\n### Options\n\n| Option | Default | Description |\n|--------|---------|-------------|\n| `service` | *(required)* | Service name: `'vercel'`, `'github'`, `'google'`, `'slack'`, `'apple'`, `'microsoft'`, `'okta'`, `'aws'`, `'resend'`, `'stripe'`, `'mongoatlas'`, `'clerk'`, `'linear'`, or `'twilio'` |\n| `port` | `4000` | Port for the HTTP server |\n| `hostname` | `127.0.0.1` | Listening address for built-in and custom emulators |\n| `seed` | none | Inline seed data (same shape as YAML config) |\n| `baseUrl` | none | Override advertised base URL. Per-service `baseUrl` in seed config takes highest priority, then this option, then `EMULATE_BASE_URL` env var (supports `{service}`), then `PORTLESS_URL` (supports `{service}`, automatically set by the `portless` CLI wrapper), then `http://localhost:`. |\n\nUse `hostname: '0.0.0.0'` to allow connections from containers or other machines, and `baseUrl` to advertise a URL reachable by those clients.\n\n### Instance methods\n\n| Method | Description |\n|--------|-------------|\n| `url` | Base URL of the running server |\n| `generatedSecrets` | Readonly secrets generated while preparing seed data |\n| `reset()` | Wipe the store and replay seed data |\n| `close()` | Shut down the HTTP server, returns a Promise |\n\n## Configuration\n\nConfiguration is optional. The CLI auto-detects config files in this order: `emulate.config.yaml` / `.yml`, `emulate.config.json`, `service-emulator.config.yaml` / `.yml`, `service-emulator.config.json`. Or pass `--seed ` explicitly. Run `npx emulate init` to generate a starter file.\n\n```yaml\ntokens:\n my_token:\n login: admin\n scopes: [repo, user]\n\nvercel:\n users:\n - username: developer\n name: Developer\n email: dev@example.com\n teams:\n - slug: my-team\n name: My Team\n projects:\n - name: my-app\n team: my-team\n framework: nextjs\n\ngithub:\n users:\n - login: octocat\n name: The Octocat\n email: octocat@github.com\n orgs:\n - login: my-org\n name: My Organization\n members:\n - login: octocat\n role: admin\n repos:\n - owner: octocat\n name: hello-world\n language: JavaScript\n auto_init: true\n\ngoogle:\n users:\n - email: testuser@example.com\n name: Test User\n - email: admin@acme.com\n name: Admin\n hd: acme.com\n oauth_clients:\n - client_id: my-client-id.apps.googleusercontent.com\n client_secret: GOCSPX-secret\n redirect_uris:\n - http://localhost:3000/api/auth/callback/google\n labels:\n - id: Label_ops\n user_email: testuser@example.com\n name: Ops/Review\n color_background: \"#DDEEFF\"\n color_text: \"#111111\"\n messages:\n - id: msg_welcome\n user_email: testuser@example.com\n from: welcome@example.com\n to: testuser@example.com\n subject: Welcome to the Gmail emulator\n body_text: You can now test Gmail, Calendar, and Drive flows locally.\n label_ids: [INBOX, UNREAD, CATEGORY_UPDATES]\n calendars:\n - id: primary\n user_email: testuser@example.com\n summary: testuser@example.com\n primary: true\n selected: true\n time_zone: UTC\n calendar_events:\n - id: evt_kickoff\n user_email: testuser@example.com\n calendar_id: primary\n summary: Project Kickoff\n start_date_time: 2025-01-10T09:00:00.000Z\n end_date_time: 2025-01-10T09:30:00.000Z\n drive_items:\n - id: drv_docs\n user_email: testuser@example.com\n name: Docs\n mime_type: application/vnd.google-apps.folder\n parent_ids: [root]\n\nslack:\n team:\n name: My Workspace\n domain: my-workspace\n users:\n - name: developer\n real_name: Developer\n email: dev@example.com\n profile:\n title: Local Developer\n status_text: Testing locally\n status_emoji: \":computer:\"\n presence: active\n channels:\n - name: general\n topic: General discussion\n - name: random\n topic: Random stuff\n bots:\n - name: my-bot\n oauth_apps:\n - client_id: \"12345.67890\"\n client_secret: example_client_secret\n app_id: A000000001\n name: My Slack App\n redirect_uris:\n - http://localhost:3000/api/auth/callback/slack\n scopes:\n - chat:write\n - channels:read\n - channels:history\n - channels:join\n - channels:manage\n - channels:write\n - groups:read\n - groups:history\n - groups:write\n - im:read\n - im:history\n - im:write\n - mpim:read\n - mpim:history\n - mpim:write\n - users:read\n - users:read.email\n - users.profile:read\n - users.profile:write\n - users:write\n - files:read\n - files:write\n - pins:read\n - pins:write\n - bookmarks:read\n - bookmarks:write\n - reactions:read\n - reactions:write\n - team:read\n user_scopes: [users:read, users.profile:read]\n bot_name: my-bot\n tokens:\n - token: xoxb-local-test\n user: developer\n scopes:\n - chat:write\n - channels:read\n - channels:history\n - channels:join\n - channels:manage\n - channels:write\n - groups:read\n - groups:history\n - groups:write\n - im:read\n - im:history\n - im:write\n - mpim:read\n - mpim:history\n - mpim:write\n - users:read\n - users:read.email\n - users.profile:read\n - users.profile:write\n - users:write\n - files:read\n - files:write\n - pins:read\n - pins:write\n - bookmarks:read\n - bookmarks:write\n - reactions:read\n - reactions:write\n - team:read\n strict_scopes: false\n\nlinear:\n organization:\n name: Acme\n url_key: acme\n users:\n - email: admin@example.com\n name: Admin User\n admin: true\n - email: dev@example.com\n name: Developer\n teams:\n - key: ENG\n name: Engineering\n states:\n - name: Backlog\n type: backlog\n - name: Todo\n type: unstarted\n - name: In Progress\n type: started\n - name: Done\n type: completed\n labels:\n - name: Bug\n color: \"#d92d20\"\n team: ENG\n - name: Feature\n color: \"#2563eb\"\n team: ENG\n issues:\n - team: ENG\n title: Fix local checkout test\n description: Reproduce and fix the checkout failure.\n state: Todo\n assignee: dev@example.com\n labels: [Bug]\n oauth_apps:\n - client_id: lin_example_client_id\n client_secret: example_client_secret\n name: My Linear App\n redirect_uris:\n - http://localhost:3000/api/auth/callback/linear\n scopes: [read, write, issues:create, comments:create]\n actor: user\n tokens:\n - token: lin_test_admin\n user: admin@example.com\n scopes: [read, write, issues:create, comments:create, admin]\n strict_scopes: false\n\napple:\n users:\n - email: testuser@icloud.com\n name: Test User\n oauth_clients:\n - client_id: com.example.app\n team_id: TEAM001\n name: My Apple App\n redirect_uris:\n - http://localhost:3000/api/auth/callback/apple\n\nmicrosoft:\n users:\n - email: testuser@outlook.com\n name: Test User\n oauth_clients:\n - client_id: example-client-id\n client_secret: example-client-secret\n name: My Microsoft App\n redirect_uris:\n - http://localhost:3000/api/auth/callback/microsoft-entra-id\n\naws:\n region: us-east-1\n s3:\n buckets:\n - name: my-app-bucket\n - name: my-app-uploads\n sqs:\n queues:\n - name: my-app-events\n - name: my-app-dlq\n iam:\n users:\n - user_name: developer\n create_access_key: true\n roles:\n - role_name: lambda-execution-role\n description: Role for Lambda function execution\n\nokta:\n users:\n - login: testuser@okta.local\n email: testuser@okta.local\n first_name: Test\n last_name: User\n groups:\n - name: Everyone\n description: All users\n type: BUILT_IN\n okta_id: 00g_everyone\n authorization_servers:\n - id: default\n name: default\n audiences: [api://default]\n oauth_clients:\n - client_id: okta-test-client\n client_secret: okta-test-secret\n name: Sample OIDC Client\n redirect_uris:\n - http://localhost:3000/callback\n auth_server_id: default\n\nresend:\n domains:\n - name: example.com\n region: us-east-1\n contacts:\n - email: test@example.com\n first_name: Test\n last_name: User\n\nstripe:\n customers:\n - email: test@example.com\n name: Test Customer\n products:\n - name: Pro Plan\n description: Monthly pro subscription\n prices:\n - product_name: Pro Plan\n currency: usd\n unit_amount: 2000\n\nmongoatlas:\n projects:\n - name: Project0\n clusters:\n - name: Cluster0\n project: Project0\n database_users:\n - username: admin\n project: Project0\n databases:\n - cluster: Cluster0\n name: test\n collections: [items]\n\nclerk:\n users:\n - first_name: Test\n last_name: User\n email_addresses: [test@example.com]\n password: clerk_test_password\n organizations:\n - name: My Company\n slug: my-company\n members:\n - email: test@example.com\n role: admin\n oauth_applications:\n - client_id: clerk_emulate_client\n client_secret: clerk_emulate_secret\n name: Emulate App\n redirect_uris:\n - http://localhost:3000/api/auth/callback/clerk\n\ntwilio:\n account:\n sid: AC00000000000000000000000000000000\n auth_token: twilio_test_auth_token\n friendly_name: Local Twilio Account\n api_keys:\n - sid: SK00000000000000000000000000000000\n secret: twilio_test_api_secret\n friendly_name: Local API Key\n phone_numbers:\n - phone_number: \"+15551234567\"\n friendly_name: Local SMS and Voice Number\n sms_url: http://localhost:3000/api/twilio/sms\n voice_url: http://localhost:3000/api/twilio/voice\n messaging_services:\n - friendly_name: Local Messaging Service\n phone_numbers: [\"+15551234567\"]\n verify_services:\n - friendly_name: Local Verify Service\n code: \"123456\"\n default_channel: sms\n conversations:\n services:\n - friendly_name: Local Conversations\n```\n\nGitHub organization `members` are optional. Each entry references a seeded user by `login`; `role` defaults to `member`, while `admin` creates an organization administrator. Unknown users are ignored. Seeded memberships use the synthetic `members` team and grant private organization repository access.\n\n## OAuth & Integrations\n\nThe emulator supports configurable OAuth apps and integrations with strict client validation.\n\n### Vercel Integrations\n\n```yaml\nvercel:\n integrations:\n - client_id: \"oac_abc123\"\n client_secret: \"secret_abc123\"\n name: \"My Vercel App\"\n redirect_uris:\n - \"http://localhost:3000/api/auth/callback/vercel\"\n```\n\n### GitHub OAuth Apps\n\n```yaml\ngithub:\n oauth_apps:\n - client_id: \"Iv1.abc123\"\n client_secret: \"secret_abc123\"\n name: \"My Web App\"\n redirect_uris:\n - \"http://localhost:3000/api/auth/callback/github\"\n```\n\nIf no `oauth_apps` are configured, the emulator accepts any `client_id` (backward-compatible). With apps configured, strict validation is enforced.\n\n### GitHub Apps\n\nFull GitHub App support with JWT authentication and installation access tokens:\n\n```yaml\ngithub:\n apps:\n - app_id: 12345\n slug: \"my-github-app\"\n name: \"My GitHub App\"\n permissions:\n contents: read\n issues: write\n events: [push, pull_request]\n webhook_url: \"http://localhost:3000/webhooks/github\"\n webhook_secret: \"my-secret\"\n installations:\n - installation_id: 100\n account: my-org\n repository_selection: all\n```\n\nJWT authentication: sign a JWT with `{ iss: \"\" }` using the app's private key (RS256). The emulator verifies the signature and resolves the app. For programmatic `createEmulator` calls, omit `private_key` and read the generated RSA key from `generatedSecrets`. The CLI generates an omitted key only when `--generated-secrets-file ` is provided; otherwise it requires an explicit, valid private key. Do not replace the omitted field with a fake PEM placeholder.\n\nInstallation access tokens act as the configured GitHub App bot for repository writes. Repository ownership, selected repository access, and requested App permissions remain enforced. Pull request merges require `contents: write` on the base repository. Pull request branch updates require `pull_requests: write` on the pull request repository and `contents: write` on the head repository.\n\nInspect secret-free metadata for minted installation tokens at `GET /_emulate/installation-tokens`.\n\n**App webhook delivery**: When events occur on repos where a GitHub App is installed, the emulator mirrors real GitHub behavior:\n- All webhook payloads (including repo and org hooks) include an `installation` field with `{ id, node_id }`.\n- If the app has a `webhook_url`, the emulator delivers the event there with the `installation` field and (if configured) an `X-Hub-Signature-256` header signed with `webhook_secret`.\n\n### Slack OAuth Apps\n\n```yaml\nslack:\n signing_secret: \"my_signing_secret\"\n oauth_apps:\n - client_id: \"12345.67890\"\n client_secret: \"example_client_secret\"\n name: \"My Slack App\"\n redirect_uris:\n - \"http://localhost:3000/api/auth/callback/slack\"\n```\n\nThe signing secret applies to every outbound Slack event subscription callback. Each signed callback includes `X-Slack-Request-Timestamp` and `X-Slack-Signature`, calculated as `v0=:\")>`. Configure the receiver with the same secret and verify the unparsed request body. If the secret is absent or empty, callbacks are unsigned.\n\n### Linear OAuth Apps\n\n```yaml\nlinear:\n oauth_apps:\n - client_id: \"lin_example_client_id\"\n client_secret: \"example_client_secret\"\n name: \"My Linear App\"\n redirect_uris:\n - \"http://localhost:3000/api/auth/callback/linear\"\n scopes: [read, write, issues:create, comments:create]\n actor: user\n```\n\n### Apple OAuth Clients\n\n```yaml\napple:\n oauth_clients:\n - client_id: \"com.example.app\"\n team_id: \"TEAM001\"\n name: \"My Apple App\"\n redirect_uris:\n - \"http://localhost:3000/api/auth/callback/apple\"\n```\n\n### Microsoft OAuth Clients\n\n```yaml\nmicrosoft:\n oauth_clients:\n - client_id: \"example-client-id\"\n client_secret: \"example-client-secret\"\n name: \"My Microsoft App\"\n redirect_uris:\n - \"http://localhost:3000/api/auth/callback/microsoft-entra-id\"\n```\n\n## Vercel API\n\nEvery endpoint below is fully stateful with Vercel-style JSON responses and cursor-based pagination.\n\n### User & Teams\n- `GET /v2/user` - authenticated user\n- `PATCH /v2/user` - update user\n- `GET /v2/teams` - list teams (cursor paginated)\n- `GET /v2/teams/:teamId` - get team (by ID or slug)\n- `POST /v2/teams` - create team\n- `PATCH /v2/teams/:teamId` - update team\n- `GET /v2/teams/:teamId/members` - list members\n- `POST /v2/teams/:teamId/members` - add member\n\n### Projects\n- `POST /v11/projects` - create project (with optional env vars and git integration)\n- `GET /v10/projects` - list projects (search, cursor pagination)\n- `GET /v9/projects/:idOrName` - get project (includes env vars)\n- `PATCH /v9/projects/:idOrName` - update project\n- `DELETE /v9/projects/:idOrName` - delete project (cascades)\n- `GET /v1/projects/:projectId/promote/aliases` - promote aliases status\n- `PATCH /v1/projects/:idOrName/protection-bypass` - manage bypass secrets\n\n### Deployments\n- `POST /v13/deployments` - create deployment (auto-transitions to READY)\n- `GET /v13/deployments/:idOrUrl` - get deployment (by ID or URL)\n- `GET /v6/deployments` - list deployments (filter by project, target, state)\n- `GET /v7/deployments` - list deployments (filter by project, target, state, commit SHA)\n- `DELETE /v13/deployments/:id` - delete deployment (cascades)\n- `PATCH /v12/deployments/:id/cancel` - cancel building deployment\n- `GET /v2/deployments/:id/aliases` - list deployment aliases\n- `GET /v3/deployments/:idOrUrl/events` - get build events/logs\n- `GET /v6/deployments/:id/files` - list deployment files\n- `POST /v2/files` - upload file (by SHA digest)\n\n### Domains\n- `POST /v10/projects/:idOrName/domains` - add domain (with verification challenge)\n- `GET /v9/projects/:idOrName/domains` - list domains\n- `GET /v9/projects/:idOrName/domains/:domain` - get domain\n- `PATCH /v9/projects/:idOrName/domains/:domain` - update domain\n- `DELETE /v9/projects/:idOrName/domains/:domain` - remove domain\n- `POST /v9/projects/:idOrName/domains/:domain/verify` - verify domain\n\n### Environment Variables\n- `GET /v10/projects/:idOrName/env` - list env vars (with decrypt option)\n- `POST /v10/projects/:idOrName/env` - create env vars (single, batch, upsert)\n- `GET /v10/projects/:idOrName/env/:id` - get env var\n- `PATCH /v9/projects/:idOrName/env/:id` - update env var\n- `DELETE /v9/projects/:idOrName/env/:id` - delete env var\n\n### Blob\nImplements the Vercel Blob API used by the `@vercel/blob` SDK (`put`, `head`, `list`, `del`).\n\n- `PUT /api/blob?pathname=` - upload a blob (honors `x-add-random-suffix`, `x-allow-overwrite`, `x-content-type`, `x-cache-control-max-age`, `x-if-match` headers)\n- `GET /api/blob?url=` - blob metadata (`head()`)\n- `GET /api/blob?prefix=&limit=&cursor=&mode=` - list blobs (`list()`, including folded mode)\n- `POST /api/blob/delete` - delete blobs (`del()`)\n- `GET /blob/:storeId/` - serve blob content (public, no auth; `?download=1` adds an attachment disposition)\n\nPoint the SDK at the emulator with two environment variables:\n\n```bash\nVERCEL_BLOB_API_URL=http://localhost:4000/api/blob\nBLOB_READ_WRITE_TOKEN=vercel_blob_rw_mystore_secret\n```\n\nAny token of the form `vercel_blob_rw__` is accepted; the store id is parsed from the token. Multipart uploads and client (browser) uploads are not supported yet.\n\n## GitHub API\n\nEvery endpoint below is fully stateful. Creates, updates, and deletes persist in memory and affect related entities.\n\n### Users\n- `GET /user` - authenticated user\n- `PATCH /user` - update profile\n- `GET /users/:username` - get user\n- `GET /users` - list users\n- `GET /users/:username/repos` - list user repos\n- `GET /users/:username/orgs` - list user orgs\n- `GET /users/:username/followers` - list followers\n- `GET /users/:username/following` - list following\n\n### Repositories\n- `GET /repos/:owner/:repo` - get repo\n- `GET /repositories/:id` - get repo by numeric ID\n- `POST /user/repos` - create user repo\n- `POST /orgs/:org/repos` - create org repo\n- `PATCH /repos/:owner/:repo` - update repo\n- `DELETE /repos/:owner/:repo` - delete repo (cascades)\n- `GET/PUT /repos/:owner/:repo/topics` - get/replace topics\n- `GET /repos/:owner/:repo/languages` - languages\n- `GET /repos/:owner/:repo/contributors` - contributors\n- `GET /repos/:owner/:repo/forks` - list forks\n- `POST /repos/:owner/:repo/forks` - create fork\n- `GET/PUT/DELETE /repos/:owner/:repo/collaborators/:username` - collaborators\n- `GET /repos/:owner/:repo/collaborators/:username/permission`\n- `POST /repos/:owner/:repo/transfer` - transfer repo\n- `GET /repos/:owner/:repo/tags` - list tags\n\n### Contents & Commit History\n- `GET /repos/:owner/:repo/readme` - get the repository README\n- `GET /repos/:owner/:repo/contents/:path` - get a file or list a directory at a ref\n- Send `Accept: application/vnd.github.raw` or `application/vnd.github.raw+json` to file Contents and README requests to receive raw bytes; directory and submodule responses remain JSON\n- `GET /:owner/:repo/raw/:ref/:path` - download file content from advertised raw URLs; this is separate from Accept negotiation\n- `PUT/DELETE /repos/:owner/:repo/contents/:path` - create, update, or delete a file and commit the change\n- `GET /repos/:owner/:repo/commits` - list commits with ref, path, author, and date filters\n- `GET /repos/:owner/:repo/commits/:ref` - get a commit with file diffs and stats\n- `GET /repos/:owner/:repo/compare/:base...:head` - compare two refs\n\n### Issues\n- `GET /repos/:owner/:repo/issues` - list (filter by state, labels, assignee, milestone, creator, since)\n- `POST /repos/:owner/:repo/issues` - create\n- `GET /repos/:owner/:repo/issues/:number` - get\n- `PATCH /repos/:owner/:repo/issues/:number` - update (state transitions, events)\n- `PUT/DELETE /repos/:owner/:repo/issues/:number/lock` - lock/unlock\n- `GET /repos/:owner/:repo/issues/:number/timeline` - timeline events\n- `GET /repos/:owner/:repo/issues/:number/events` - events\n- `POST/DELETE /repos/:owner/:repo/issues/:number/assignees` - manage assignees\n\n### Pull Requests\n- `GET /repos/:owner/:repo/pulls` - list (filter by state, head, base)\n- `POST /repos/:owner/:repo/pulls` - create\n- `GET /repos/:owner/:repo/pulls/:number` - get\n- `PATCH /repos/:owner/:repo/pulls/:number` - update\n- `PUT /repos/:owner/:repo/pulls/:number/merge` - merge (with branch protection enforcement)\n- `GET /repos/:owner/:repo/pulls/:number/commits` - list commits\n- `GET /repos/:owner/:repo/pulls/:number/files` - list files\n- `POST/DELETE /repos/:owner/:repo/pulls/:number/requested_reviewers` - manage reviewers\n- `PUT /repos/:owner/:repo/pulls/:number/update-branch` - update branch\n\n### Comments\n- Issue comments: full CRUD on `/repos/:owner/:repo/issues/:number/comments`\n- Review comments: full CRUD on `/repos/:owner/:repo/pulls/:number/comments`\n- Commit comments: full CRUD on `/repos/:owner/:repo/commits/:sha/comments`\n- Repo-wide listings for each type\n\n### Reviews\n- `GET /repos/:owner/:repo/pulls/:number/reviews` - list\n- `POST /repos/:owner/:repo/pulls/:number/reviews` - create (with inline comments)\n- `GET/PUT /repos/:owner/:repo/pulls/:number/reviews/:id` - get/update\n- `POST /repos/:owner/:repo/pulls/:number/reviews/:id/events` - submit\n- `PUT /repos/:owner/:repo/pulls/:number/reviews/:id/dismissals` - dismiss\n\n### Labels & Milestones\n- Labels: full CRUD, add/remove from issues, replace all\n- Milestones: full CRUD, state transitions, issue counts\n\n### Branches & Git Data\n- Branches: list, get, protection CRUD (status checks, PR reviews, enforce admins)\n- Refs: get, match, create, update, delete\n- Commits: get, create\n- Trees: get (with recursive), create (with inline content)\n- Blobs: get, create\n- Tags: get, create\n\n### Organizations & Teams\n- Orgs: get, update, list\n- Org members: list, check, remove, get/set membership\n- Teams: full CRUD, members, repos\n\n### Releases\n- Releases: full CRUD, latest, by tag\n- Release assets: full CRUD, upload\n- Generate release notes\n\n### Webhooks\n- Repo webhooks: full CRUD, ping, test, deliveries\n- Org webhooks: full CRUD, ping\n- Real HTTP delivery to registered URLs on all state changes\n\n### Search\n- `GET /search/repositories` - full query syntax (user, org, language, topic, stars, forks, etc.)\n- `GET /search/issues` - issues + PRs (repo, is, author, label, milestone, state, etc.)\n- `GET /search/users` - users + orgs\n- `GET /search/code` - blob content search\n- `GET /search/commits` - commit message search\n- `GET /search/topics` - topic search\n- `GET /search/labels` - label search\n\n### Actions\n- Workflows: list, get, enable/disable, dispatch\n- Workflow runs: list, get, cancel, rerun, delete, logs\n- Jobs: list, get, logs\n- Artifacts: list, get, delete\n- Secrets: repo + org CRUD\n\n### Checks\n- Check runs: create, update, get, annotations, rerequest, list by ref/suite. Ref based lookups accept branch and tag refs containing slashes.\n- Check suites: create, get, preferences, rerequest, list by ref. Ref based lookups accept branch and tag refs containing slashes.\n- Automatic suite status rollup from check run results\n\n### Misc\n- `GET /rate_limit` - rate limit status\n- `GET /meta` - server metadata\n- `GET /octocat` - ASCII art\n- `GET /emojis` - emoji URLs\n- `GET /zen` - random zen phrase\n- `GET /versions` - API versions\n\n## Google OAuth + Gmail, Calendar, and Drive APIs\n\nOAuth 2.0, OpenID Connect, and mutable Google Workspace-style surfaces for local inbox, calendar, and drive flows.\n\nGoogle ID tokens are RS256-signed JWTs. The discovery document advertises RS256, and `/oauth2/v3/certs` returns the matching RSA public key used to verify issued tokens.\n\n- `GET /o/oauth2/v2/auth` - authorization endpoint\n- `POST /oauth2/token` - token exchange\n- `GET /oauth2/v2/userinfo` - get user info\n- `GET /.well-known/openid-configuration` - OIDC discovery document\n- `GET /oauth2/v3/certs` - JSON Web Key Set (JWKS) with the RSA public key for ID token verification\n- `GET /gmail/v1/users/:userId/messages` - list messages with `q`, `labelIds`, `maxResults`, and `pageToken`\n- `GET /gmail/v1/users/:userId/messages/:id` - fetch a Gmail-style message payload in `full`, `metadata`, `minimal`, or `raw` formats\n- `GET /gmail/v1/users/:userId/messages/:messageId/attachments/:id` - fetch attachment bodies\n- `POST /gmail/v1/users/:userId/messages/send` - create sent mail from `raw` MIME or structured fields\n- `POST /gmail/v1/users/:userId/messages/import` - import inbox mail\n- `POST /gmail/v1/users/:userId/messages` - insert a message directly\n- `POST /gmail/v1/users/:userId/messages/:id/modify` - add/remove labels on one message\n- `POST /gmail/v1/users/:userId/messages/batchModify` - add/remove labels across many messages\n- `POST /gmail/v1/users/:userId/messages/:id/trash` and `POST /gmail/v1/users/:userId/messages/:id/untrash`\n- `GET /gmail/v1/users/:userId/drafts`, `POST /gmail/v1/users/:userId/drafts`, `GET /gmail/v1/users/:userId/drafts/:id`, `PUT /gmail/v1/users/:userId/drafts/:id`, `POST /gmail/v1/users/:userId/drafts/:id/send`, `DELETE /gmail/v1/users/:userId/drafts/:id`\n- `POST /gmail/v1/users/:userId/threads/:id/modify` - add/remove labels across a thread\n- `GET /gmail/v1/users/:userId/threads` and `GET /gmail/v1/users/:userId/threads/:id`\n- `GET /gmail/v1/users/:userId/labels`, `POST /gmail/v1/users/:userId/labels`, `PATCH /gmail/v1/users/:userId/labels/:id`, `DELETE /gmail/v1/users/:userId/labels/:id`\n- `GET /gmail/v1/users/:userId/history`, `POST /gmail/v1/users/:userId/watch`, `POST /gmail/v1/users/:userId/stop`\n- `GET /gmail/v1/users/:userId/settings/filters`, `POST /gmail/v1/users/:userId/settings/filters`, `DELETE /gmail/v1/users/:userId/settings/filters/:id`\n- `GET /gmail/v1/users/:userId/settings/forwardingAddresses`, `GET /gmail/v1/users/:userId/settings/sendAs`\n- `GET /discovery/v1/apis/calendar/v3/rest` — public Calendar v3 REST discovery document\n- `GET /calendar/v3/users/:userId/calendarList`, `GET /calendar/v3/calendars/:calendarId/events`, `POST /calendar/v3/calendars/:calendarId/events`, `DELETE /calendar/v3/calendars/:calendarId/events/:eventId`, `POST /calendar/v3/freeBusy`\n- `GET /drive/v3/files`, `GET /drive/v3/files/:fileId`, `POST /drive/v3/files`, `PATCH /drive/v3/files/:fileId`, `PUT /drive/v3/files/:fileId`, `POST /upload/drive/v3/files`\n\n## Slack API\n\nFully stateful Slack Web API emulation with channels, messages, threads, reactions, user profiles, presence, modern file uploads, pins, bookmarks, views, OAuth v2, and incoming webhooks. Chat writes preserve common rich message fields such as `blocks`, `attachments`, `metadata`, formatting flags, unfurl flags, and client message ids. Conversation writes update archive state, names, topics, purposes, membership, DMs, MPIMs, and read cursors. User writes update profile fields, status, custom fields, and deterministic active or away presence. File writes support the current external upload flow with local upload URLs, file share messages, reads, lists, downloads, and deletes. Pin and bookmark writes support channel message pins and link bookmarks. View writes support App Home publishing and modal stacks. Seeded OAuth apps and OAuth installs create bot users and installation records. OAuth exchanges and explicit token seeds create scoped token records. Supported write state changes dispatch Slack `event_callback` payloads to configured webhook URLs.\n\nSet `slack.signing_secret` in seed config to sign every outbound event subscription callback. The emulator sends `X-Slack-Request-Timestamp` and `X-Slack-Signature`, where the signature is `v0=:\")>`. Configure the receiver with the same secret and verify the unparsed request body. Without a secret, callbacks are unsigned.\n\nSlack message text is limited to 40,000 Unicode characters across chat writes, incoming webhooks, and file upload initial comments. Longer text is truncated at a Unicode code point boundary before it is stored or dispatched. Successful Web API responses include `warning: \"message_truncated\"` and `response_metadata` with the matching warning and explanatory message. Rich fields such as `blocks` and `attachments` are preserved unchanged.\n\n### Auth & Chat\n- `POST /api/auth.test` - test authentication\n- `POST /api/chat.postMessage` - post message with text or rich payload fields (supports threads via `thread_ts` and DM user IDs)\n- `POST /api/chat.postEphemeral` - post ephemeral message outside channel history\n- `POST /api/chat.update` - update message text and rich payload fields\n- `POST /api/chat.delete` - delete message\n- `GET /api/chat.getPermalink` / `POST /api/chat.getPermalink` - get message permalink\n- `POST /api/chat.scheduleMessage` - schedule pending message\n- `POST /api/chat.deleteScheduledMessage` - delete pending scheduled message\n- `POST /api/chat.scheduledMessages.list` - list pending scheduled messages\n- `POST /api/chat.meMessage` - /me message\n\n### Conversations\n- `POST /api/conversations.list` - list conversations (cursor pagination, `types`, `exclude_archived`)\n- `POST /api/conversations.info` - get channel info\n- `POST /api/conversations.create` - create channel\n- `POST /api/conversations.archive` / `conversations.unarchive` - archive/restore channel\n- `POST /api/conversations.rename` - rename channel\n- `POST /api/conversations.setTopic` / `conversations.setPurpose` - update topic/purpose\n- `POST /api/conversations.history` - channel history with rich message fields\n- `POST /api/conversations.replies` - thread replies with rich message fields\n- `POST /api/conversations.join` / `conversations.leave` - join/leave\n- `POST /api/conversations.invite` / `conversations.kick` - manage membership\n- `POST /api/conversations.open` / `conversations.close` - open/close DMs and MPIMs\n- `POST /api/conversations.mark` - mark read cursor\n- `POST /api/conversations.members` - list members\n\n### Users & Reactions\n- `POST /api/users.list` - list users (cursor pagination)\n- `POST /api/users.info` - get user info\n- `POST /api/users.lookupByEmail` - lookup by email\n- `GET /api/users.profile.get` / `POST /api/users.profile.get` - get user profile fields\n- `POST /api/users.profile.set` - update profile fields, status, and custom fields\n- `GET /api/users.getPresence` / `POST /api/users.getPresence` - get active or away presence\n- `POST /api/users.setPresence` - set the authed user to away or automatic presence\n- `POST /api/reactions.add` / `reactions.remove` / `reactions.get` - manage reactions\n\n### Files\n- `POST /api/files.getUploadURLExternal` - create a local external upload session\n- `POST /upload/v1/:fileId` - receive raw uploaded file bytes\n- `POST /api/files.completeUploadExternal` - complete uploads and optionally share file messages\n- `GET /api/files.info` / `POST /api/files.info` - get file metadata\n- `GET /api/files.list` / `POST /api/files.list` - list completed files\n- `GET /files-pri/:fileId/:filename` - download file bytes with a bearer token that can access the file\n- `POST /api/files.delete` - delete a completed file\n\n### Pins & Bookmarks\n- `POST /api/pins.add` - pin a message to a channel\n- `GET /api/pins.list` / `POST /api/pins.list` - list pinned message items for a channel\n- `POST /api/pins.remove` - remove a message pin from a channel\n- `POST /api/bookmarks.add` - add a link bookmark to a channel\n- `POST /api/bookmarks.edit` - update a link bookmark\n- `POST /api/bookmarks.list` - list channel bookmarks\n- `POST /api/bookmarks.remove` - remove a bookmark from a channel\n\n### Views\n- `POST /api/views.publish` - publish or update an App Home view for a user\n- `POST /api/views.open` - open a modal view\n- `POST /api/views.update` - update a view by `view_id` or `external_id`\n- `POST /api/views.push` - push a modal view onto the current modal stack\n- `POST /api/views.generateTriggerId` - local helper for tests that need a modal trigger id\n\nModal opens and pushes require values from `/api/views.generateTriggerId`. Pass the returned value as `trigger_id` or `interactivity_pointer`; generate push values with an existing `view_id` and use them within 3 seconds.\n\n### Team, Bots & Webhooks\n- `POST /api/team.info` - workspace info\n- `POST /api/bots.info` - bot info\n- `POST /services/:teamId/:botId/:webhookId` - incoming webhook with text or rich payload fields\n\n### OAuth\n- `GET /oauth/v2/authorize` - authorization (shows user picker)\n- `POST /oauth/v2/authorize/callback` - local user picker callback that creates the auth code\n- `POST /api/oauth.v2.access` - token exchange\n\n### Inspector\n- `GET /` - tabbed local inspector for conversations, messages, files, views, auth records, incoming webhooks, event subscriptions, and event deliveries\n\nWhen a supported Slack write emits an `event_callback`, the payload contains the inner `event` plus outer `team_id`, `event_id`, and `event_time`. The team comes from the presented Slack token's installation; development tokens without a stored Slack record fall back to the affected channel, user, or file's team, then the seeded workspace team (or `T000000001`). Incoming webhook posts use their webhook record's team, or the target channel's team when no record matches. `event_time` is an integer Unix timestamp in seconds. Each logical event gets a new `event_id`, shared across deliveries to multiple subscribers.\n\nSlack scope checks are relaxed by default so local tests can use simple bearer tokens. Set `slack.strict_scopes: true` in seed config to make supported Web API methods return Slack-style `missing_scope` errors with `needed` and `provided` fields. Strict mode checks `chat:write`, `channels:read`, `channels:history`, `channels:join`, `channels:manage`, `channels:write`, `groups:read`, `groups:history`, `groups:write`, `im:read`, `im:history`, `im:write`, `mpim:read`, `mpim:history`, `mpim:write`, `users:read`, `users:read.email`, `users.profile:read`, `users.profile:write`, `users:write`, `files:read`, `files:write`, `pins:read`, `pins:write`, `bookmarks:read`, `bookmarks:write`, `reactions:read`, `reactions:write`, and `team:read`. Slack lists no method-specific scopes for `views.publish`, `views.open`, `views.update`, or `views.push`, so the emulator requires auth but does not add strict-scope checks for those methods.\n\nCurrent Slack limits: Slack Connect, Enterprise Grid admin APIs, Audit Logs API, SCIM, Legal Holds, Socket Mode, slash command and interaction simulation, user groups, reminders, stars, calls, canvases, lists, functions, workflows, chat streaming, legacy `files.upload`, exact rate limiting, and paid-plan behavior are not implemented.\n\n## Linear API\n\nStateful Linear GraphQL API emulation with seeded organizations, users, teams, workflow states, issues, comments, labels, projects, cycles, OAuth apps, tokens, webhooks, and basic agent sessions. GraphQL reads and writes mutate in-memory state and use Relay-style connections with opaque cursors. OAuth supports authorization code, PKCE, refresh token, revoke, client credentials, and `actor=app` tokens for local app-actor tests. Supported writes dispatch Linear-shaped webhook payloads with `Linear-Delivery`, `Linear-Event`, and `Linear-Signature` headers when webhooks are configured.\n\n### GraphQL\n\n- `POST /graphql` - GraphQL endpoint for queries and mutations\n- `GET /graphql` - query-string GraphQL endpoint for tooling\n- Queries: `viewer`, `organization`, `users`, `user`, `teams`, `team`, `workflowStates`, `workflowState`, `issues`, `issue`, `comments`, `comment`, `issueLabels`, `issueLabel`, `projects`, `project`, `cycles`, `cycle`, `webhooks`, `webhook`, `agentSessions`, `agentSession`\n- Mutations: `issueCreate`, `issueUpdate`, `issueDelete`, `issueArchive`, `issueUnarchive`, `commentCreate`, `commentUpdate`, `commentDelete`, `issueLabelCreate`, `issueLabelUpdate`, `issueLabelDelete`, `issueAddLabel`, `issueRemoveLabel`, `webhookCreate`, `webhookDelete`, `agentSessionCreateOnIssue`, `agentSessionCreateOnComment`, `agentSessionUpdate`, `agentActivityCreate`\n\nIssue selections expose both numeric `priority` and Linear's derived `priorityLabel` values: `No priority`, `Urgent`, `High`, `Medium`, and `Low`.\n\n### OAuth\n\n- `GET /oauth/authorize` - authorization endpoint with local user picker\n- `POST /oauth/authorize/callback` - local user picker callback that creates an authorization code\n- `POST /oauth/token` - authorization code, refresh token, and client credentials grants\n- `POST /oauth/revoke` - revoke access or refresh tokens\n\nOAuth app `actor` config is authoritative. Apps configured with `actor: user` use authorization code flows. Apps configured with `actor: app` use the app install flow and can request client credentials tokens.\n\n### Webhooks And Inspector\n\n- `webhookCreate` / `webhookDelete` manage local webhook subscriptions\n- `GET /` - tabbed local inspector for issues, teams, users, projects, agents, auth records, webhook subscriptions, and deliveries\n\nLinear scope checks are relaxed by default so local tests can use simple bearer tokens or the seeded `lin_test_admin` token. Set `linear.strict_scopes: true` in seed config to require `read`, `write`, `issues:create`, `comments:create`, or `admin` on supported GraphQL operations.\n\nCurrent Linear limits: full schema coverage, exact production rate limiting, notification inbox behavior, rich document APIs, customer APIs, initiative APIs, exact search relevance, and production agent behavior are not implemented. Agent support is a focused local-test subset.\n\n## Twilio API\n\nStateful Twilio REST emulation with seeded accounts, Auth Tokens, API keys, incoming phone numbers, Programmable Messaging, Messaging Services, Verify, basic Voice calls, Conversations REST resources, signed webhooks, local simulator routes, and an inspector. No real SMS, MMS, WhatsApp, email, voice, carrier, compliance, billing, or SendGrid traffic is performed.\n\nDefault local credentials:\n\n```text\nTWILIO_ACCOUNT_SID=AC00000000000000000000000000000000\nTWILIO_AUTH_TOKEN=twilio_test_auth_token\nTWILIO_API_KEY=SK00000000000000000000000000000000\nTWILIO_API_SECRET=twilio_test_api_secret\nTWILIO_PHONE_NUMBER=+15551234567\nTWILIO_VERIFY_SERVICE_SID=VA00000000000000000000000000000000\n```\n\n### REST Routes\n\n- `GET /2010-04-01/Accounts/{AccountSid}.json` - fetch account\n- `GET /2010-04-01/Accounts/{AccountSid}/IncomingPhoneNumbers.json` - list phone numbers\n- `POST /2010-04-01/Accounts/{AccountSid}/Messages.json` - create outbound message\n- `GET /2010-04-01/Accounts/{AccountSid}/Messages.json` - list messages\n- `POST /2010-04-01/Accounts/{AccountSid}/Calls.json` - create outbound call\n- `POST /messaging/v1/Services` - create Messaging Service\n- `POST /verify/v2/Services/{ServiceSid}/Verifications` - start verification\n- `POST /verify/v2/Services/{ServiceSid}/VerificationCheck` - check verification code\n- `POST /conversations/v1/Services` - create Conversation Service\n- `POST /conversations/v1/Services/{ServiceSid}/Conversations` - create Conversation\n- `POST /conversations/v1/Services/{ServiceSid}/Conversations/{ConversationSid}/Participants` - add participant\n- `POST /conversations/v1/Services/{ServiceSid}/Conversations/{ConversationSid}/Messages` - add message\n\nTwilio uses multiple product hosts. For local SDK tests, rewrite Twilio SDK requests to the emulator and map `messaging.twilio.com` to `/messaging`, `verify.twilio.com` to `/verify`, and `conversations.twilio.com` to `/conversations`.\n\n### SMS And OTP Testing\n\nFor the common SMS verification loop, the seeded Verify Service uses code `123456`. Start a verification through the normal Verify API, then either submit `123456` in your app test or fetch the latest local code with the authenticated helper route:\n\n```sh\ncurl -u \"$TWILIO_ACCOUNT_SID:$TWILIO_AUTH_TOKEN\" \\\n \"http://localhost:4000/_twilio/simulate/verification-code?To=%2B15550002222&ServiceSid=$TWILIO_VERIFY_SERVICE_SID\"\n```\n\nThe helper returns the latest local verification for that phone number, including `verification_sid`, `status`, `attempts`, and `code`. It is local-only test support and is not part of Twilio's production API. The Verify inspector also shows each attempted code.\n\nTo test inbound SMS webhooks, configure a seeded phone number `sms_url`, then call `POST /_twilio/simulate/inbound-message` with `To`, `From`, and `Body`. If the destination number is assigned to a Messaging Service with `inbound_request_url`, the simulator sends the inbound webhook there and includes `MessagingServiceSid`; otherwise it uses the phone number `sms_url`. To test outbound delivery transitions, create a message with `StatusCallback`, then call `POST /_twilio/simulate/message-status`.\n\n### Simulator And Inspector\n\n- `POST /_twilio/simulate/inbound-message` - create an inbound message and invoke the configured SMS webhook\n- `POST /_twilio/simulate/message-status` - advance message status and send status callbacks\n- `GET /_twilio/simulate/verification-code` - fetch the latest local Verify code by `VerificationSid` or `To`\n- `POST /_twilio/simulate/inbound-call` - create an inbound call and invoke the configured voice webhook\n- `POST /_twilio/simulate/call-status` - advance call status\n- `POST /_twilio/simulate/verification-status` - force a verification state by `VerificationSid` or `To`\n- `GET /` - tabbed inspector for messages, Verify, calls, Conversations, phone numbers, services, auth, and webhook deliveries\n\nCurrent Twilio limits: no carrier delivery, A2P 10DLC, toll-free verification, real phone number purchasing, exact rate limits, Studio, Flex, TaskRouter, Video, Sync, Segment, SendGrid, Conversations SDK websocket behavior, or complete TwiML interpreter.\n\n## Apple Sign In\n\nSign in with Apple emulation with authorization code flow, PKCE support, RS256 ID tokens, and OIDC discovery.\n\n- `GET /.well-known/openid-configuration` - OIDC discovery document\n- `GET /auth/keys` - JSON Web Key Set (JWKS)\n- `GET /auth/authorize` - authorization endpoint (shows user picker)\n- `POST /auth/token` - token exchange (authorization code and refresh token grants)\n- `POST /auth/revoke` - token revocation\n\n## Microsoft Entra ID\n\nMicrosoft Entra ID (Azure AD) v2.0 OAuth 2.0 and OpenID Connect emulation with authorization code flow, PKCE, client credentials, client-bound refresh tokens, RS256 ID tokens, and OIDC discovery.\n\n- `GET /.well-known/openid-configuration` - OIDC discovery document\n- `GET /:tenant/v2.0/.well-known/openid-configuration` - tenant-scoped OIDC discovery\n- `GET /discovery/v2.0/keys` - JSON Web Key Set (JWKS)\n- `GET /oauth2/v2.0/authorize` - authorization endpoint (shows user picker)\n- `POST /oauth2/v2.0/token` - token exchange (authorization code, refresh token, client credentials)\n- `GET /oidc/userinfo` - OpenID Connect user info\n- `GET /v1.0/me` - Microsoft Graph user profile\n- `GET /oauth2/v2.0/logout` - end session / logout\n- `POST /oauth2/v2.0/revoke` - token revocation\n\nRefresh token requests must include the `client_id` and `client_secret` of the client that received the token. Refresh tokens rotate after successful use. Legacy refresh records without a stored client binding remain supported.\n\n```bash\ncurl -X POST http://localhost:4005/oauth2/v2.0/token \\\n -H \"Content-Type: application/x-www-form-urlencoded\" \\\n -d \"refresh_token=r_microsoft_...&\\\nclient_id=example-client-id&\\\nclient_secret=example-client-secret&\\\ngrant_type=refresh_token\"\n```\n\n## AWS\n\nS3, SQS, IAM, and STS emulation with AWS SDK-compatible S3 paths and query-style SQS/IAM/STS endpoints. S3 uploads and downloads preserve arbitrary binary payloads, including raw byte lengths and ETags. All responses use AWS-compatible XML.\n\n### S3\n\nS3 routes use root paths matching the real AWS S3 wire format, so the official AWS SDK works out of the box with `forcePathStyle: true`. Legacy `/s3/` prefixed paths are also supported for backward compatibility.\n\n- `GET /` - list all buckets\n- `PUT /:bucket` - create bucket\n- `DELETE /:bucket` - delete bucket\n- `HEAD /:bucket` - check existence\n- `GET /:bucket` - list objects (prefix, delimiter, max-keys, continuation-token, start-after)\n- `POST /:bucket` - presigned POST upload (browser-style multipart form with policy validation)\n- `PUT /:bucket/:key` - put object (supports copy via `x-amz-copy-source`)\n- `GET /:bucket/:key` - get object\n- `HEAD /:bucket/:key` - head object\n- `DELETE /:bucket/:key` - delete object\n\n### SQS\nAll operations via `POST /sqs/` with `Action` parameter:\n- `CreateQueue`, `ListQueues`, `GetQueueUrl`, `GetQueueAttributes`\n- `SendMessage`, `ReceiveMessage`, `DeleteMessage`\n- `PurgeQueue`, `DeleteQueue`\n\n### IAM\nAll operations via `POST /iam/` with `Action` parameter:\n- `CreateUser`, `GetUser`, `ListUsers`, `DeleteUser`\n- `CreateAccessKey`, `ListAccessKeys`, `DeleteAccessKey`\n- `CreateRole`, `GetRole`, `ListRoles`, `DeleteRole`\n\n### STS\nAll operations via `POST /sts/` with `Action` parameter:\n- `GetCallerIdentity`, `AssumeRole`\n\n## Next.js Integration\n\nEmbed emulators directly in your Next.js app so they run on the same origin. This solves the Vercel preview deployment problem where OAuth callback URLs change with every deployment.\n\n### Install\n\n```bash\nnpm install @emulators/adapter-next @emulators/github @emulators/google\n```\n\nOnly install the emulators you need. Each `@emulators/*` package is published independently.\n\n### Route handler\n\nCreate a catch-all route that serves emulator traffic:\n\n```typescript\n// app/emulate/[...path]/route.ts\nimport { createEmulateHandler } from '@emulators/adapter-next'\nimport * as github from '@emulators/github'\nimport * as google from '@emulators/google'\n\nexport const { GET, POST, PUT, PATCH, DELETE } = createEmulateHandler({\n services: {\n github: {\n emulator: github,\n seed: {\n users: [{ login: 'octocat', name: 'The Octocat' }],\n repos: [{ owner: 'octocat', name: 'hello-world', auto_init: true }],\n },\n },\n google: {\n emulator: google,\n seed: {\n users: [{ email: 'test@example.com', name: 'Test User' }],\n },\n },\n },\n})\n```\n\nGitHub App seeds may omit `private_key`. Retain the handler to call server-only `generatedSecrets()`; explicit keys are excluded. Persisted snapshots contain generated keys, so keep the backend private.\n\n### Auth.js / NextAuth configuration\n\nPoint your provider at the emulator paths on the same origin:\n\n```typescript\nimport GitHub from 'next-auth/providers/github'\n\nconst baseUrl = process.env.VERCEL_URL\n ? `https://${process.env.VERCEL_URL}`\n : 'http://localhost:3000'\n\nGitHub({\n clientId: 'any-value',\n clientSecret: 'any-value',\n authorization: { url: `${baseUrl}/emulate/github/login/oauth/authorize` },\n token: { url: `${baseUrl}/emulate/github/login/oauth/access_token` },\n userinfo: { url: `${baseUrl}/emulate/github/user` },\n})\n```\n\nNo `oauth_apps` need to be seeded. When none are configured, the emulator skips `client_id`, `client_secret`, and `redirect_uri` validation.\n\n### Font files in serverless\n\nEmulator UI pages use bundled fonts. Wrap your Next.js config to include them in the serverless trace:\n\n```typescript\n// next.config.mjs\nimport { withEmulate } from '@emulators/adapter-next'\n\nexport default withEmulate({\n // your normal Next.js config\n})\n```\n\nIf you mount the catch-all at a custom path, pass the matching prefix:\n\n```typescript\nexport default withEmulate(nextConfig, { routePrefix: '/api/emulate' })\n```\n\n### Persistence\n\nBy default, emulator state is in-memory and resets on every cold start. To persist state across restarts, pass a `persistence` adapter:\n\n```typescript\nimport { createEmulateHandler } from '@emulators/adapter-next'\nimport * as github from '@emulators/github'\n\nconst kvAdapter = {\n async load() ",
"bytes": 60000,
"sha": "a86a34e0c23175a65de00108c55e0aa4bfd7a7067996024444c2e1ec9950a3eb",
"repo_slug": "vercel-labs/emulate",
"fonte": "repo",
"truncated": false,
"api": "https://api.agentalog.com/api/listings/skl_vercel_labs_emulate_vercel_2a87efea/readme"
}
![\"Vercel](\"https://img.shields.io/badge/LABS-EXPERIMENT-0a0a0a.svg?style=for-the-badge&logo=Vercel&labelColor=000000\"){kind=icon}
\n ![\"npm](\"https://img.shields.io/npm/v/emulate.svg?style=for-the-badge&labelColor=000000\")
\n ![\"License:](\"https://img.shields.io/github/license/vercel-labs/emulate.svg?style=for-the-badge&labelColor=000000\")
\n ![\"npm](\"https://img.shields.io/npm/dm/emulate.svg?style=for-the-badge&labelColor=000000&label=npm%20downloads\")
\n