See what's exposed in your APIs
Import your OpenAPI spec or GraphQL schema and test every operation in it with payload-based tests, including prompt injection on AI endpoints.
Where API Scanning fits
Every product runs on the same Discovery layer. API Scanning uses the same fuzzing engine as Application Scanning, driven by your OpenAPI spec or GraphQL schema instead of a crawler.
Discovery
The system of record for your attack surface. Every asset flows through Discovery, so assessments read from it and findings feed back into it.
How API Scanning works
Test every operation your spec defines
Upload an OpenAPI spec or GraphQL schema and API Scanning builds the scan from it. It parses each endpoint and operation and shows any parsing errors, so you know what will be tested. For GraphQL, you pick the queries and mutations to scan and give sample values.
- OpenAPI v2 and v3 specs
- GraphQL queries and mutations, with sample values you provide
- An inventory of the APIs you have added
A different set of payloads every run
Payloads are tracked per target and rotated between runs, so each scan works further through the list instead of repeating the last one. When a payload gets a result, it's stored and prioritized for verification in the next scans. Findings are confirmed by running the payload, not by matching a signature.
- Payloads tracked per target and rotated between runs
- Payloads that get a result are verified in the next scans
- Findings confirmed by payload execution, with exploitability context
Prompt injection testing for AI endpoints
If your API puts an LLM behind an endpoint, API Scanning tests it for prompt injection. It generates prompt injection payloads from combinations, with more than 922 quintillion possible (how dynamic fuzzing works). Each scan runs a couple dozen payloads per vulnerability type and rotates them between runs.
- Prompt injection tests for AI and LLM endpoints
- Around 330,000 command injection payloads
- SQL and NoSQL injection, SSTI, XXE, XSS, SSRF and path traversal
Set it up once, then scan on a schedule
Add the server address, authentication and the operations you want tested, then set a schedule. Recurring scans catch regressions and newly introduced vulnerabilities as your API changes.
- OAuth, Basic Auth and API key authentication
- Recurring scans to catch regressions
- Throttling for APIs that need a lighter load
Send findings where your team works
Findings go to Jira, Slack, Microsoft Teams, PagerDuty, Splunk and webhooks, and to 100s more tools via Workato. Use the REST API to pull results into your own workflows.
- Jira, Slack and Microsoft Teams
- PagerDuty and Splunk
- Webhooks, Workato and the REST API
Jira
PagerDutyWhere security teams put API Scanning to work
AI and LLM endpoints
Test the endpoints that talk to your models
An endpoint that passes user input to an LLM can be steered. API Scanning sends prompt injection payloads to your AI endpoints and rotates them between runs.
Customer-facing APIs
Test the APIs your customers build on
Public and partner APIs are part of your product. Import the spec and test each operation in it for injection, SSRF and TLS issues.
Regression testing
Catch what changed since the last release
APIs change with every release. Recurring scans catch regressions and newly introduced vulnerabilities, and findings go to the tools your developers already use.
If you have a cumbersome manual process or don't have enough insight into your attack surface, Detectify can really help.
FAQs
SQL and NoSQL injection, SSTI, prompt injection on AI and LLM endpoints, command injection, XXE, XSS, SSRF, path traversal, LDAP, JSON and CRLF injection, certificate and SSL/TLS issues, Edge-Side Includes, and GraphQL introspection left enabled in production.
Findings are confirmed by running the payload against your API, not by matching a signature. Each one comes with exploitability context, so your team can see why it matters.
An OpenAPI v2 or v3 spec or a GraphQL schema, the server address, and authentication details. OAuth, Basic Auth and API keys are supported. If the spec has parsing errors, you'll see them in the app so you can fix them.
It tests the operations in your spec, so an endpoint or parameter that's missing from the spec won't be tested. It doesn't discover APIs for you. It doesn't test client-side or DOM issues, which Application Scanning covers, or business logic and authorization flaws such as BOLA and BFLA. gRPC and WebSocket APIs, GraphQL subscriptions, Postman collections, HAR files and mTLS aren't supported.
You choose which operations are tested, and you can throttle the scanner for APIs that need a lighter load. Scans typically take 5 to 30 minutes or more, depending on how many endpoints there are.
SaaS, with nothing to install. Your API needs to be reachable from the internet. For APIs on internal networks, see Internal Scanning.
Both use the same fuzzing engine. Application Scanning crawls a web app in a real browser and finds inputs as it goes. API Scanning has no crawler: it tests the operations defined in your spec or schema, including endpoints no page links to.
Pricing is per target, tiered by the number of targets, starting at €90 per month per API. See pricing.
Surface Monitoring
Finds the domains, subdomains, IPs and open ports you have on the internet, and recommends which apps need a deeper scan.
Learn more about Surface Monitoring
Application Scanning
Crawls and fuzzes the web apps you build, including single-page apps and the parts behind login.
Learn more about Application Scanning
Internal Scanning
The same payload-based testing for internal apps, through an agent that only connects outbound.
Learn more about Internal ScanningAdd your OpenAPI spec and start scanning
Payload-based testing for every endpoint in your OpenAPI spec or GraphQL schema, including prompt injection tests for AI endpoints. Payloads rotate with every scan, so your coverage grows over time.