Stoplight Prism API Mock Server

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## A Live Mock API From Your Own Specification, In Minutes

Stoplight Prism is a popular open source HTTP mock server and request and response validation proxy. You point it at an API description in OpenAPI, Swagger or Postman format and it stands up a live mock server in seconds: every endpoint returns realistic, schema conformant example responses, and every incoming request is validated against the contract so mismatches are caught immediately. It lets front end, mobile and integration teams build against an API before the real backend exists, and lets teams prove that a running service actually honours its published contract.

This image delivers Prism fully installed and ready to run so a working mock API endpoint is operational within minutes of launch, with no manual package installation, no Node.js version wrangling and no service configuration required. A sensible starter OpenAPI specification is included and served on first boot, so you can call a live mock immediately and then replace it with your own description whenever you are ready.

## Secure By Default

Prism itself has no native authentication, so rather than expose an open mock this image binds Prism to the loopback interface and fronts it with an nginx reverse proxy that enforces HTTP Basic authentication on the public port. A unique Basic authentication password is generated for your instance on first boot, before the mock is reachable, and written to a root only file. No shared or default credentials ship in the image, and the mock returns only synthetic example data from the specification you provide, exposing no host secret, no filesystem and no administrative surface. Prism runs as a dedicated unprivileged system user under a hardened systemd service with the operating system kept read only outside its own state directory.

## Why This AMI Over Self-Deployment

• Minutes instead of hours: skip installing Node.js, pinning the runtime, wiring a systemd service and standing up a reverse proxy. Launch the instance, retrieve the generated password and call the mock.
• Authenticated out of the box: the nginx front door enforces HTTP Basic authentication with a per instance credential, so the mock is never left open to anyone who can reach the port.
• A working mock immediately: a starter OpenAPI specification is served on first boot, so a live, schema conformant mock answers on the standard port straight away and you swap in your own description when ready.
• Mock, proxy and validate: run Prism as a mock, as a validation proxy in front of a real upstream, or with dynamic schema generated responses, all switched from a single environment file.

## Getting Started

1. Launch the AMI on your chosen instance type. Prism is a lightweight Node.js process, so a general purpose instance is ample.

2. SSH into the instance and retrieve the generated Basic authentication credential from the root only file.

3. Call the mock API on the published port using that credential, or point your test suite and CI agents at it.

4. Replace the sample specification with your own OpenAPI, Swagger or Postman description and restart the service.

5. Switch between mock, proxy and dynamic modes from the environment file as your workflow requires.

## Application Stack

Prism (@stoplight/prism-cli) is installed from the public npm registry at a pinned release on the Node.js 24 LTS runtime it requires. It runs as an unprivileged system account under a hardened systemd unit, bound to the loopback interface, and nginx fronts it on the public port with HTTP Basic authentication. The current release available is Prism 5.16.0.

## 24/7 cloudimg Support

cloudimg provides round-the-clock technical support by email and live chat. Our engineers help with serving your own API descriptions, mock versus proxy versus validation modes, tuning the contract validation behaviour, fronting the mock with your own TLS terminating proxy, and integrating the mock into test suites and CI pipelines. Critical issues receive a one-hour average response time.

## Use Cases

• Stand up a live mock API from an OpenAPI, Swagger or Postman description so front end, mobile and integration teams build before the backend exists.
• Validate that requests and responses conform to an API contract, catching mismatches early in development and CI.
• Run a contract validation proxy in front of a real service to enforce its published specification.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them. Stoplight and Prism are marks of their respective owner and are used here only to identify the software.