What developers build with WhoHitsMyAPI
From abuse detection to customer discovery — four real ways API builders use traffic analytics to ship faster, charge more, and sleep better.
Identify Who Is Calling Your API
See callers by IP, API key, and behavioral fingerprint
The problem
You ship a public or partner-facing API. Traffic goes up — but your logs just say '10,000 requests today.' You have no idea whether that's one power user, a hundred small integrators, or a single scraper running wild.
The solution
WhoHitsMyAPI enriches every request with caller IP, user-agent, API key, and custom caller IDs you pass from your own middleware. The dashboard groups traffic by distinct caller so you see exactly who account for the most volume.
How it works
- 1Add one line of middleware to your API server (Express, FastAPI, Rails, etc.)
- 2Pass your own callerId (e.g. company name or user ID) in the payload — or let WhoHitsMyAPI use IP + user-agent fingerprinting
- 3Open the dashboard: your top callers are ranked by request volume, with first-seen and last-seen timestamps
Outcome
Within minutes of adding the middleware you know your top 10 API consumers by name, volume, and first contact date.
Best for: API-first SaaS founders, platform teams
Catch API Abuse Before It Costs You
Detect scrapers, rate-limit violators, and anomalous traffic
The problem
A competitor is scraping your product catalog via your undocumented API. Or a bot is hammering your search endpoint, running up your database bill. You only find out when the cloud invoice arrives.
The solution
WhoHitsMyAPI logs every inbound request with timestamp, endpoint, method, status code, and latency. You can filter by caller or endpoint to spot traffic spikes, abnormal request patterns, or a single IP making thousands of calls per hour.
How it works
- 1Send requests to the ingest endpoint with endpoint, method, statusCode, and callerIp in the payload
- 2In the dashboard, sort by request count and filter by time window to spot anomalies
- 3Export the caller IP or API key and add it to your firewall or rate-limit blocklist
Outcome
Identify and block abusive callers before they exceed your free quota or inflate your infrastructure costs.
Best for: Security-aware developers, platform engineers
Turn API Consumers Into Paying Customers
Find high-value users hiding in your traffic logs
The problem
Your API has dozens of external consumers — partners, hobbyists, startups — but you have no idea who they are or which ones are serious enough to convert to a paid plan.
The solution
When you instrument your API with WhoHitsMyAPI, you see which callers hit which endpoints most frequently. High-volume, consistent callers who query your most valuable endpoints are prime conversion candidates.
How it works
- 1Pass callerId with the company name or email domain of authenticated API users
- 2Sort the dashboard by request count and endpoint depth to identify power users
- 3Reach out to top callers with a personalized note — you know exactly how they use your API
Outcome
Convert anonymous API traffic into a ranked list of leads with real usage data to personalize your outreach.
Best for: SaaS founders, developer-relations teams
Understand Endpoint-Level Traffic Patterns
See which routes are popular, slow, or error-prone
The problem
Your API has 50 endpoints but you optimize based on guesses. You don't know if /search is called 100x more than /export, or whether your POST endpoints have a higher error rate than your GETs.
The solution
WhoHitsMyAPI aggregates traffic by endpoint, method, and status code. You can see at a glance which routes carry the most load, which have elevated 4xx or 5xx rates, and which are essentially unused.
How it works
- 1Pass endpoint and method in each ingest payload (e.g., /api/search, GET)
- 2Optionally include statusCode and latencyMs for full request context
- 3Use the analytics dashboard to sort endpoints by request count, error rate, or average latency
Outcome
Make data-driven decisions about caching, rate limits, and deprecation — informed by real traffic, not assumptions.
Best for: Backend developers, platform architects
Start identifying your API callers today
Free plan includes 10,000 requests per month. No credit card required. Add one line to your API and see traffic in minutes.