Hosted Agent
The Hosted Agent runs as a container inside your own network and executes scan traffic against APIs that the internet cannot reach — the agent connects out to APIsec, and nothing connects in. Start with the quickstart to get one running, then read how it works.
📖 Quickstart
APIsec's cloud cannot reach APIs that live only inside your network. A Hosted Agent solves that: it is a small APIsec worker that runs on a server in your environment, so scans can reach those internal-only APIs. The agent makes outbound-only connections to APIsec — nothing inbound is opened.
📖 How it works
Some of your APIs are internal-only — reachable inside your network but not from the public internet, and so not from APIsec's cloud. To assess them for vulnerabilities, APIsec needs a secure way to reach them. The Hosted Agent is that path: it runs as a container inside your own network and executes scan traffic against APIs that have no public route, without exposing those APIs to the internet. The agent reaches out to APIsec; APIsec never reaches in. This page explains what the agent does, why it connects the way it does, and how a scan flows through it, so you can reason about its behavior and its trust boundary in your environment.
📖 Deploy with Docker
To scan APIs that APIsec's cloud cannot reach, deploy the Hosted Agent as a Docker container on a host inside your network. This guide takes you from creating the agent in the console to a container reporting ACTIVE.
📖 Deploy on Kubernetes
To run the Hosted Agent on your cluster instead of a standalone Docker host, deploy it as a Kubernetes Deployment. The console generates Docker install commands (Linux and Windows) — there is no Kubernetes-specific installer — so you adapt the environment values from the downloaded command into a manifest. The agent itself behaves the same either way: it polls the platform outbound and executes scan traffic against your target APIs.
📖 Scale with replicas
To increase how much scan traffic an agent can execute in parallel, run more than one container on the same agent token. Each container is a replica of the same agent: replicas share the agent's instruction queue and split the work between them automatically.
📖 Networking & egress
This page lists every network connection the Hosted Agent makes, so you can write firewall and egress policy for it.
📖 Troubleshooting
This runbook is organized by symptom. Find the behavior you're seeing, then work through its checks in order.
📖 Upgrading & versions
To upgrade the Hosted Agent you run a newer container image. This page explains how, and how the version string you see in the console relates — and doesn't relate — to what you're actually running.
📖 Configuration reference
Complete reference for the Hosted Agent's environment variables, install command parameters, execution limits, and status lifecycle.
📖 Certificates & mTLS
This guide is for teams deploying a private hosted agent against APIs that require client-certificate authentication (mTLS), a custom Certificate Authority (CA), or both.
📖 Proxy configuration
If your network only allows outbound HTTPS through a proxy, configure the Hosted Agent's built-in proxy support so its connection to the APIsec platform can transit it. The agent supports HTTP and SOCKS proxies, with optional authentication.
📖 Manage Hosted Agents
A hosted agent is a lightweight component deployed within your environment that communicates with the APISec platform and performs API discovery, testing, and security scanning from inside the network boundary.