API Security

Path: /api-security · Sidebar: Testing → API Security

API Security audits your APIs from their specification and behaviour: it inventories endpoints, assesses risk, and maps findings to the OWASP API Security Top 10.

What it does

• OpenAPI / Swagger audit - import a spec and check it for security issues (missing auth, weak schemes, over-broad scopes, verbose errors).
• Endpoint inventory - a catalogue of endpoints with detected tech stack and risk rating.
• OWASP API Top 10 assessment - coverage against the API-specific risk categories (BOLA, broken auth, excessive data exposure, etc.).
• Spec conformance - where the running API diverges from its declared spec.

Get started

1. Open API Security.
2. Provide an OpenAPI/Swagger spec (upload or URL), or point at an API target.
3. Review the endpoint inventory and the Top 10 findings.
4. Drill into any endpoint for its risk detail; findings unify into the Vulnerabilities hub.

Relationship to DAST

DAST actively attacks running endpoints (including schema fuzzing for APIs), while API Security focuses on the spec and inventory view. Together they cover both "is the design safe?" and "does it hold up under attack?". For active API testing, run a DAST scan against the API target.