Skip to main content
When --spec points at an HTML page rather than a spec, pikopod climbs a ladder. The first line of output names the rung that succeeded.

The ladder

Rungs 1 to 4 are deterministic and need no key. Only if all four miss does pikopod reach rung 5, and with no key configured it stops and tells you so rather than degrading quietly. The linked-document rungs deliberately have no same-host restriction, because documentation sites legitimately host their spec on another domain. If your threat model includes SSRF from an untrusted docs page, fetch the spec yourself and pass a local path. See Security.

A model-written contract is a draft

Extracted fields are simulated, so the sandbox is useful at all for a provider that ships no spec, but the guess is carried, labelled, and outranked:
  • Marked DRAFT in pikopod sandbox list.
  • Capped below ERR in any spec diff.
  • Never unlock readable enum values in recordings.
  • Cannot bind a failure archetype without an explicit --bind. scenario list prints the line to use. See Binding.
  • Lose to observed traffic whenever the two disagree.
If some indexed pages did not fit the extraction budget, they are listed, so you know the spec is partial.

Make the facts yours

The extracted spec is written with an x-pikopod-origin: llm-extracted marker. Review it, add x-pikopod-trigger to each webhook event or bind them in a webhooks sidecar, commit it, and import from the file from then on, with no model in the loop:
It re-imports as DRAFT until you delete the marker line, which says the facts are now yours.

Webhooks from a docs import

A documentation page rarely says which API call fires which event. Bind them without re-importing:
See Webhooks.