Onboarding overview
APIsec tests your API by exercising its endpoints, so it first needs an accurate model of your API's shape — the endpoints, methods, parameters, and payloads. Onboarding is how you give APIsec that model. Once your API is onboarded, APIsec generates a tailored suite of security tests and can start scanning.
You can onboard an API in several ways. Choose the source that matches what you already have: a specification, an API gateway, a Postman workspace, source code, a browser session, or captured traffic.
Choose an onboarding method
Onboarding Sources catalogs every source — spec upload, API gateway integrations, Postman, Code Bolt, Browser Bolt, traffic capture, and GraphQL — and when to use each.
If your API is not reachable from the internet
APIsec needs to reach your API to test it. If your API is internal-only or otherwise not reachable from the internet, you also need a Hosted Agent to run scans against it. See Do I need a Hosted Agent? to decide.
After onboarding
Once your API is onboarded, continue with:
- Manage applications and environments — rename an application, and add, edit, or remove environments.
- Manage endpoints — configure parameters, headers, and request bodies, and add endpoints manually.
- Check endpoint readiness — validate that an endpoint is configured before a full scan.