Before uploading anything, we’d recommend reviewing all the endpoints in the schema in the context of the authorised account you’re giving the scanner access to. (The scanner is going to call every endpoint in the schema, so if the account can modify data through the API (eg. PUT/POST/DELETE), the scanner is going to modify that data).
If testing in production, we'd recommend you take the necessary precautions to remove any sensitive endpoints (and avoid authorising via admin accounts).
If testing in staging, be aware that if it's not a direct copy of production, the coverage may be compromised.
API scanning is available to users with an Application license.
More information on our licensing can be found here.
Head to the Targets page > click '
+ Add Target', then click the top box 'External Infrastructure':
In the first box, please enter the target you wish to scan and hit '
Add Target':
Pop the target into the search bar and click it:
You'll then be taken to the target's detail page, where you have the option to add an API schema, by clicking the
APIstab, followed by the green+ Add API Schemabutton:
From here you'll need to click the top box
OpenAPI/Swagger:
👉 Use the first field to give your schema file a name (so you can identify it in the portal)
👉 The second section is for uploading your schema file (for now, we're only supporting
.jsonand.yml)👉 The third field is where you add the Base URL – this defines the location of the API (or where the API "lives". It's important to note that the Base URL must match the target you're adding the schema to.
(For example, if the target isapi-test-rig.intruder.esyou couldn't setexample.api-test-rig.intruder.esas the Base URL as that's a different target).
Then clickNext:
At this point you can choose to add authentication (existing or new) or choose to skip. (You can always revisit this at a later stage, if you wish).
If you skip, you'll end up on your target's detail page:
If you choose to add authentication to a new target, you'll want to click
Add new authentication:
And then select one from the following list (there are guides hyperlinked below for your reference):
- HTTP
- Header
- Session-cookie
