API endpoint scanning

APIs are a top attack surface and often less protected than the UIs in front of them. The API engine tests endpoints directly for issues like broken authorisation, injection and excessive data exposure.

It is the right tool when your product is an API, or when a web/mobile app talks to a backend you want to harden.

You describe the API (base URL, and optionally a spec like OpenAPI/Swagger) and SecNxt exercises each endpoint with security-focused requests across the HTTP method matrix (GET/POST/PUT/PATCH/DELETE), not just reads.

The Deep profile adds OWASP API Top-10 depth: broken object- and function-level authorisation (IDOR/BFLA) across methods, mass-assignment of privileged fields, missing rate limiting on auth-sensitive endpoints, and JWT integrity abuse (forged alg:none and signature-stripped tokens). For GraphQL it tests introspection, field-suggestion schema leakage and query batching. Blind detection runs too: time-based payloads prove blind SQL injection and an out-of-band (OAST) callback system catches blind SSRF.

Findings capture the endpoint, the technique and how to reproduce, then flow into the shared findings model. Forged-JWT acceptance, mass-assignment, missing rate limits, time-based delays and out-of-band callbacks are marked 'Verified'.

1. 1Pick 'API Endpoint Scan' on the New scan screen.
2. 2Provide the base URL and any API spec or example requests.
3. 3Add authentication (API keys/tokens) so protected endpoints are tested.
4. 4Select the Deep profile for blind injection and out-of-band testing.
5. 5Run the scan and review results.

• Hardening a public or partner API.
• Checking authorisation logic across many endpoints.
• Validating an API gateway configuration.

• Supplying an OpenAPI spec dramatically improves coverage.
• Test with realistic roles to surface broken-object-level-authorisation issues.
• Supply a bearer JWT to enable JWT integrity testing (alg:none and signature-strip).
• Use the Deep profile to enable mass-assignment, rate-limit, JWT and out-of-band checks.

Do you support GraphQL?

Yes — provide the endpoint and a sample query/schema. SecNxt tests introspection, field-suggestion schema leakage (when introspection is disabled) and unrestricted query batching.

How do you find vulnerabilities that return no error?

The Deep profile uses time-based techniques (making the database pause on a malicious input) and out-of-band callbacks (the server reaching back to a unique SecNxt URL). Both produce reproducible proof of blind injection and SSRF without relying on an error message.