Onboarding Sources
APIsec builds its model of your API — endpoints, methods, parameters, and payloads — from a source you provide, and that model drives the security tests it generates. Several sources work. Pick the one that matches what you already have, then follow its guide.
A spec you already have
If you hold an OpenAPI or Swagger spec (.json or .yaml), upload it. This is the fastest path to a complete, accurate model. See Onboard an API with an OpenAPI spec.
Your API gateway
If your APIs are managed by a gateway or an API management platform, APIsec retrieves their definitions directly from it — no file handling, and you can onboard more APIs later through the same connection. Connect the platform you run:
Your Postman workspace
If your API lives in Postman collections, connect your Postman account with an API key and onboard from the workspaces you can access. See Postman.
Generated from source code — Code Bolt
If your code lives on GitHub and you have no spec, Code Bolt generates one from the source. It runs as a GitHub Action, so the spec regenerates as the code changes — you need permission to add a workflow and secrets to the repository. See Code Bolt.
Generated from a browser session — Browser Bolt
If you can exercise the API's web application in a browser, Browser Bolt — a Chrome extension — captures parameters and payloads as you use it and builds the spec from real usage. See Browser Bolt.
Captured traffic
If you can record real HTTP requests and responses — with browser developer tools, a proxy, or a testing tool — onboard from the capture: HAR, Burp XML, or Mitmproxy.
GraphQL
Onboard a GraphQL API from its schema file (SDL) and endpoint URL. See GraphQL.
Not sure which fits?
Start from what you have. A spec, a gateway connection, or a Postman workspace onboards APIs that are already documented; Code Bolt, Browser Bolt, and traffic capture generate the spec for you when none exists; GraphQL APIs onboard from their schema. For the decision-tree version, see Discover and Document my APIs.