I already have Applications API specifications
If you have an OpenAPI or Swagger spec for your API, you are on the fastest onboarding path. APIsec reads the spec to learn your API's endpoints, methods, parameters, and payloads, then generates a tailored suite of security tests. This page points you to the steps.
Upload your spec
APIsec accepts OpenAPI and Swagger spec files in .json or .yaml format. Onboarding takes one pass through the UI: add an application, choose OpenAPI Spec, upload the file, and validate the environment URL — the base URL where your API runs.
Follow the full steps in Onboard an API with an OpenAPI spec.
Validate your spec with a tool such as Swagger Editor to catch errors before you upload it.
Keep the spec in sync
Your API changes; your test coverage should follow. Reload the spec at any time from a file, a URL, or your API gateway. See Reload Spec.
If your API is internal-only
APIsec has to reach your API to test it. If your API is not reachable from the public internet, you also need a Hosted Agent to run scans from inside your network. See Do I need a Hosted Agent? to decide.
After onboarding
- Manage endpoints — configure parameters, headers, and request bodies, and add endpoints.
- Manage applications and environments — rename the application and manage its environments.
No spec yet? Start with Discover and Document my APIs instead.