Discovery & Documentation
Identifies all endpoints, parameters and auth mechanisms.
[ api security ]
Every endpoint. Every token. Tested continuously.
Discovers REST, GraphQL, SOAP and microservice endpoints, then attacks authentication, authorization and business logic.
REST & GraphQLModern API architectures
AuthenticationOAuth, JWT, API keys
Data ValidationInput/output security
Rate LimitingDoS protection
[ live terminal ]
From a 401 to a finding, in one run.
API Endpoint AnalysisSample report
- Total Endpoints
- 47
- Authenticated
- 32
- Public
- 15
- Vulnerable
- 12
[ what the agent does ]
Four passes over every API, end to end.
Authentication & Authorization
Tests token handling and access controls.
Data Validation & Business Logic
Hunts injection and logic flaws.
Security Controls Assessment
Rate limiting, encryption, logging.
[ sample finding ]
What lands in your queue.
High
Endpoint GET /api/v1/users/{userId}
Broken Object Level Authorization
The API endpoint allows users to access other users' data by manipulating the userId parameter without proper authorization checks.
[ recommendation ]
Implement proper authorization checks to ensure users can only access their own data or data they have explicit permission to access.
[ coverage: owasp api top 10 ]
The full OWASP API Top 10, and the logic beyond it.
- Broken Object Level Authorization
- Broken Authentication
- Excessive Data Exposure
- Lack of Resources & Rate Limiting
- Broken Function Level Authorization
- Mass Assignment
- Security Misconfiguration
- Injection
- Improper Assets Management
- Insufficient Logging & Monitoring
- Business Logic Flaws+ beyond top 10
- Insecure Direct Object References+ beyond top 10
[ api types ]
Whatever your services speak.
REST APIs
- HTTP methods testing
- JSON/XML validation
- Resource-based security
- CORS policies
GraphQL APIs
- Query complexity analysis
- Schema introspection
- Authorization testing
- Batching attacks
SOAP Web Services
- WSDL analysis
- XML injection testing
- WS-Security validation
- SOAP fault handling
Microservices
- Service mesh security
- Inter-service auth
- API gateway testing
- Container security
[ early access ]