📖 Reachability Flow via Hosted Agent
If your target API is internal or not reachable from the public internet, you'll likely need a Hosted Agent to scan it. See Do I Need a Hosted Agent? to decide, then follow the Hosted Agent quickstart to deploy one.
📖 Endpoint Readiness
Endpoint readiness tells you whether an endpoint is configured well enough to return a real, successful response when APIsec scans it. Without it, a scan can fail on authentication or missing parameter values and report hollow coverage. Readiness — shown in the console as Testability Status — answers one question up front: will this endpoint actually be exercised?
📖 Unauthenticated Scan
An unauthenticated scan tests your API as an anonymous caller — no credentials attached. It shows what is exposed before authentication is enforced: endpoints that should require auth but don't, public endpoints leaking sensitive data, and missing rate limiting. Run it as the first scan on a newly onboarded API (no credentials needed), and again after auth-related changes; pair it with an authenticated scan for the full picture.
📖 Authenticated Scan
An authenticated scan exercises your API with valid credentials, so it reaches the endpoints where the highest-impact vulnerabilities live — broken authorization, BOLA, and privilege escalation. It requires an authentication profile on the application; set one up first in Configure authentication. Run it alongside the unauthenticated scan to cover both sides of the auth boundary.
📖 Scan Profiles
Scan profiles are reusable scan configurations. Create a profile once, then apply it when you initiate ad-hoc or scheduled scans instead of configuring each scan from scratch.
📖 Schedule Scans
Scheduled scans automate scanning at regular intervals. Run scans daily, weekly, or monthly by specifying the time, day of the week, or day of the month. Once scheduled, scans run automatically with the selected authentication, scan profile, and hosted agent, providing continuous and consistent security coverage.
📖 CI/CD Integration
Run an APIsec scan from your pipeline and fail the build when serious vulnerabilities exceed the limits you set. This shifts API security testing left: every push or merge request is scanned, and a build cannot ship while CRITICAL or HIGH findings breach your thresholds.
🗃️ Hosted Agents
12 items
📖 Dynamic Parameter Values
APIsec can resolve a parameter value at scan time instead of holding a fixed value you have to maintain. Rather than configuring a parameter with 15, you configure it with @random.val.int.1.20; when the scan starts, APIsec resolves the token and uses the result.