Discover and Document my APIs
Before APIsec can test an API, it needs to know the API's shape — its endpoints, methods, parameters, and payloads. Getting that model into APIsec is called onboarding. This page helps you pick the right onboarding method based on what you already have, then points you to the steps.
Pick your path
Start from what you have today and follow the matching method.
| What you have | Method | Where to start |
|---|---|---|
An OpenAPI or Swagger spec (.json or .yaml) | Upload the spec — the fastest path | Onboard with an OpenAPI spec |
| No spec, but you can capture live traffic | Onboard from recorded HTTP traffic | HAR, Burp XML, Mitmproxy |
| No spec, but you can run the app or access its code | Generate a spec with Bolt | Browser Bolt, Code Bolt |
| A GraphQL API | Onboard from an SDL schema and endpoint URL | GraphQL |
If your API is internal-only
APIsec has to reach your API to test it. If your API is not reachable from the public internet, you also need a Hosted Agent to run scans from inside your network. See Do I need a Hosted Agent? to decide.
See all methods
This page routes you to the common paths. For every onboarding method, integration, and what happens after onboarding, see the Onboarding overview.