Self-Hosted API Documentation That Never Calls Home

An OpenAPI spec often describes more than a public API’s shape — internal-only routes, auth header names, staging URLs, field names that hint at how a system is built. For teams under security or compliance requirements, sending that document to a third-party service just to render it isn’t always an option, even when the service itself is reputable.

Why self-hosting matters here

A lot of “publish your docs” tools mean “publish to our platform.” Postman’s published docs live on the postman.co domain (a custom domain is a paid-plan feature); Scalar and Stoplight both offer hosted cloud tiers alongside their open-source viewers. That’s a fine trade-off for a public-facing marketing-style docs page. It’s a harder sell when the spec being rendered isn’t meant to leave your own network at all.

How GetMan runs self-hosted

GetMan is a script, not a platform. You host getman-ui.js yourself — pull it into your own asset pipeline or mirror it on infrastructure you control — and call GetMan.launch() against a spec URL that can be entirely internal, unreachable from outside your VPN. Nothing renders server-side and nothing phones home to a GetMan-operated service: the script fetches the spec URL you give it and renders it in the visitor’s browser, the same way any other static asset on your page would behave.

<div id="api-docs" style="height: 100vh"></div>
<script src="/vendor/getman-ui.js"></script>
<script>
  GetMan.launch(document.getElementById('api-docs'), {
    url: 'https://internal.your-domain.com/openapi.json',
  });
</script>

Because it’s MIT-licensed, the source is also auditable if that’s part of your review process — there’s no minified black box between “script tag” and “what actually runs in the browser.”

What this looks like in practice

Behind a VPN or on an intranet, this setup needs no outbound network calls beyond the two you already control: the request for the script asset, and the request for the spec itself. Compliance review becomes a question about your own infrastructure, not a third party’s data-handling policy.