Skip to main content

API Scanning

APIs are their own attack surface. Cybrium's API scan imports your specification, learns your auth scheme, and fuzzes every endpoint — including the ones your crawler never reached.

Plan-gated

API scanning is available on the Pro and Enterprise plans.

What it discovers​

  • Endpoints, methods, parameters, and response schemas derived from your spec.
  • Authentication and authorisation issues — broken object-level auth, function-level auth gaps, IDOR, and privilege escalation.
  • Input-handling flaws — injection, mass assignment, prototype pollution, unsafe deserialisation.
  • Rate-limit and abuse controls — missing throttles, enumerable identifiers, information disclosure.
  • Drift between the spec and the live implementation.

When to use it​

Run it on every new API before it ships, on every spec change, and on a schedule against staging and production. Pair it with DAST for web-app coverage and with SAST for code coverage — API scanning covers the protocol layer between the two.

Requires authorisation

The target host must pass the ownership liveness check before the scan is dispatched.

Import a spec​

  1. Go to Scans -> New Scan -> API.
  2. Provide a spec in OpenAPI 3, Swagger 2, or Postman Collection format. You can paste JSON or YAML, point to a URL, or upload a file.
  3. Cybrium parses the spec, resolves $refs, and shows you the endpoint inventory for review. Remove any endpoints you do not want tested.

Screenshot: API spec import with parsed endpoint inventory

Configure auth​

Pick from a library of auth templates:

  1. Bearer token — paste a static or refreshable token.
  2. API key — header, query, or cookie.
  3. OAuth 2.0 — client credentials, authorisation code, or device flow, with automatic token refresh.
  4. Basic auth — username and password pair.
  5. Custom script — a short inline script that produces headers for each request, for signed requests or HMAC schemes.

Cybrium fires a smoke test against a known-good endpoint before the scan starts and tells you exactly why auth failed if it does.

Launch the scan​

  1. Pick a profile — Safe (read-only methods), Standard (everything except destructive mutations), or Full (every method).
  2. Start the scan. The phase tracker streams endpoint-by-endpoint progress.

What findings look like​

Each finding names the endpoint, method, parameter, the mutation that triggered it, the response delta, severity, and an OWASP API Top 10 mapping. Evidence includes full request and response pairs for reproduction.

Where results appear​

  • Findings tab with filters for endpoint, method, and auth context.
  • Topology tab draws the API graph with edges for auth boundaries.
  • Report tab produces a developer-friendly appendix keyed by endpoint.

Screenshot: API finding with request/response diff and OWASP mapping