API Security
Path: /api-security · Sidebar: API Security
API Security is a scored discipline in its own right, not a spec viewer. It gives your API estate a single A-F risk grade, inventories every endpoint with its sensitivity and provenance, and ties code to runtime so you know not just what your APIs should do but what they actually do.
The hero score
The page leads with one number: an A-F API risk grade computed on the same curve as the org posture score. It answers "how exposed is our API estate right now?" in a form you can put in front of leadership, and it drives the CI gate.
Below it, four KPIs summarise the estate: the risk grade, toxic combinations, code-to-runtime coverage, and the endpoint count.
Toxic combinations
The headline risk signal is the toxic combination: an endpoint that is public + handles sensitive data + is not provably authenticated. Any one of those is normal; together they are a "Risky" verdict - a single, prioritised finding and a red marker in the inventory, rather than three separate low-signal observations.
Endpoint inventory
A catalogue of every endpoint with:
- Sensitivity - typed data-class tags (PII / PCI / PHI / secret) detected on the endpoint.
- Provenance - whether it is seen in Code + Runtime, From source only, or Runtime only (see Code to Runtime).
- Auth state - proven-public only when a verified finding demonstrates unauthenticated access, never assumed.
- Findings - the API-scoped issues on that endpoint.
Open any row for the endpoint drawer: a slide-over with the facts, provenance, data classes and findings for that one endpoint.
The four tabs
| Tab | What it holds |
|---|---|
| Overview | Hero grade, KPIs, toxic combinations, data-class summary, compliance |
| Inventory | The full endpoint catalogue with sensitivity / provenance / auth filters |
| Findings | API-scoped vulnerabilities, unified into the Vulnerabilities hub |
| Spec & Contract | Attach an OpenAPI spec and diff declared-vs-runtime (see Contract as Truth) |
What sets it apart
- Code to runtime - the SAST + DAST provenance differentiator: every endpoint is labelled by whether it is proven in source, at runtime, or both.
- Contract as truth - attach the declared OpenAPI spec and surface shadow, undocumented and auth-drift endpoints.
- Discovery & runtime correlation - find external / shadow APIs agentlessly, and fold gateway/WAF logs in to mark what is truly runtime-confirmed.
- CI gate & export - fail a pipeline below a score threshold and export SARIF 2.1.0.
Get started
- Open API Security and read the grade and toxic combinations.
- Attach a target's OpenAPI spec on the Spec & Contract tab to unlock contract-as-truth drift.
- Work the Inventory, starting with the risky (toxic) endpoints.
- Wire the score gate into CI once you trust the number.
For active attacks against a running API, run a DAST scan with an OpenAPI spec URL - the two views answer "is the design safe?" and "does it hold up under attack?" together.