Skip to main content

Confirm endpoints are testable before you scan

Endpoint readiness tells you whether an endpoint is configured well enough to return a real, successful response when APIsec scans it. Without it, a scan can fail on authentication or missing parameter values and report hollow coverage. Readiness — shown in the console as Testability Status — answers one question up front: will this endpoint actually be exercised?

A Dry Run is how you find out. It is a single-endpoint probe that sends one request, captures the response, and records whether the endpoint is testable.

This page explains what readiness and the Dry Run are, then walks through running a Dry Run and moving an endpoint to Ready for deep coverage.

What endpoint readiness is​

Readiness measures a single endpoint against one rule. An endpoint is testable when all three conditions hold:

  • The instance is reachable.
  • The endpoint returns a 2xx response.
  • The response contains no API errors.

When an endpoint meets this rule, a scan can exercise it deeply. When it does not, a scan reaches the endpoint but cannot produce meaningful coverage.

What a Dry Run does​

A Dry Run is a readiness probe, not a scan. It sends one request to the endpoint, optionally using a credential you choose, captures the response, and records the resulting Testability Status.

A Dry Run does not run the vulnerability test suite. Use it to confirm that an endpoint is configured correctly before you commit to a full scan, or to troubleshoot an endpoint that is not returning the response you expect.

The testability states​

Every endpoint sits in one of three states. The console shows the status label and a short message in the endpoint's detail panel.

StateMessage shownWhat it means
TESTABLEReady for deep coverage.The Dry Run succeeded. APIsec will test the endpoint deeply.
NOT_YET_TESTEDReady to test. Execute Dry Run to evaluate completeness for deeper coverage.No Dry Run has confirmed deep readiness yet.
NOT_TESTABLEReady to test. Configure below for deeper coverage.The last probe did not meet the testability rule — which includes the endpoint being unreachable. The panel shows the failed Request and Response so you can see why and fix it.

An underconfigured endpoint — one missing a valid credential or realistic parameter values — resolves to NOT_TESTABLE, with the failing response shown in the panel. There is no separate state for a missing credential versus a missing parameter.

A rate-limited target is the exception. If the endpoint returns HTTP 429, the panel explains that instead of showing the target's own response — the endpoint is not misconfigured, so reduce scan concurrency or raise the limit on your gateway rather than changing the credential or the parameter values.

note

After you hydrate parameters, the Endpoints tab uses a parallel two-label version of the same idea: Ready For Deep Coverage or Needs configuration for Deep Coverage. These map to the three states in the table, which remain the primary model.

Where readiness fits the scan flow​

Readiness sits between configuration and scanning:

  1. Onboard the API.
  2. Confirm the instance URL is reachable. See Reachability.
  3. Configure authentication and hydrate parameters. See Adding parameter values.
  4. Confirm endpoints are testable with a Dry Run — this page.
  5. Run a full vulnerability scan. See Configure an authenticated scan.
note

Readiness validation is now built into scan execution. During a scan, APIsec re-validates each endpoint's reachability and testability and updates the Testability Status automatically on success. You no longer have to re-run a Dry Run by hand to keep readiness current. Manual Dry Runs remain available for troubleshooting a specific endpoint.

Run a Dry Run​

Follow these steps to probe a single endpoint and read its readiness.

Before you begin​

  • The instance must be Reachable first. If it is not, the Dry Run is blocked with the message: "We are not yet able to reach this application's host server URL. Please fix the reachability prior to running scans." Resolve reachability before continuing — see Reachability.
  • Have the credential you want the Dry Run to use in mind. The Dry Run can also run without a credential.
note

The Dry Run action is unavailable to the Viewer and Global Viewer roles, and on expired trials.

Steps​

  1. Open the endpoint's detail panel and click Dry Run. The Dry Run modal opens.
  2. In Select Authentication, choose the credential the Dry Run should use. The dropdown lists the instance's credentials plus a None option and defaults to None.
  3. Click Start Dry Run. The button shows Dry Run in Progress while the probe runs.
  4. Read the Test Results. The panel shows the Testability Status, the Request (URL, headers, and body), and the Response (status code and body).
  5. If the status is NOT_TESTABLE, review the failing Request and Response. Fix the credential or the parameter values, then run the Dry Run again.
tip

Choose the credential deliberately in Select Authentication. A Dry Run uses only the credential you pick, so selecting the right one avoids a false negative from an invalid or mismatched credential. If a credential fails, the console suggests: "Dry run failed for the selected authentication. Please try again with a different authentication."

Move an endpoint to Ready for deep coverage​

An endpoint often reports NOT_TESTABLE or NOT_YET_TESTED because its parameters have no realistic values. Hydrating parameters is the primary way to make it testable: APIsec's AI infers realistic values, wires producer-to-consumer dependencies across endpoints, and executes requests to confirm they work.

  1. Open the Endpoints tab (Discover and Hydrate Parameters by Endpoint).
  2. Click Discover Parameters the first time, or Re-Discover Parameters to run it again.
  3. Pick an authentication profile for discovery, then confirm to begin.
  4. When hydration finishes, check each endpoint's label: Ready For Deep Coverage or Needs configuration for Deep Coverage.
  5. For any endpoint that still needs configuration, adjust its authentication or parameter values and run a Dry Run to confirm the fix.

For a full walkthrough of parameter values, see Discover parameters.