API Scanning from an OpenAPI Description

API Scanning from an OpenAPI Description

An API has no pages to crawl, so FortWatch tests it from the description you already keep. Attach the OpenAPI 3 or Swagger 2 description of an API an asset serves, add a test credential, and FortWatch sends test requests to every operation the description declares. It runs only when someone starts it, and it is part of every plan.

Attach the Description

1. Open the asset (verified and active) and find the API testing tab.
2. Upload the description: OpenAPI 3 or Swagger 2, JSON or YAML, up to 5 MB, with at least one operation.
3. Add the test credential and the header it goes in. A bare token under Authorization is sent as Bearer <token>; a value with its own scheme, or under another header, is sent as typed.
4. Tick the consent box and save.

The credential is sealed as soon as you save it. FortWatch shows only its scheme and last characters afterwards, and never puts it in logs, findings or AI answers. Removing the description removes the credential and the consent too. Attaching a description needs the Manager role or above; starting a test needs the Member role or above.

Where the Requests Go

Requests go to the asset, under the path of the description's first server: an API served under /v1 is tested under /v1. When the description names a host your proof covers (the asset, its www twin, or a name under a domain you proved by DNS), the requests go there. A host your proof does not cover is flagged on the card, which tells you to attach the description on that host's own asset or prove the domain by DNS. The scan never reaches anything else.

Run the Test

Click Test API. Where the description has a GET it can use, FortWatch first checks the credential with one request; if the API refuses it, the scan fails with the reason instead of passing with nothing tested. Then it tests every declared operation. Follow it in the scan's live activity.

Reading the Result

Findings become ordinary issues with evidence, an SLA and a reproduce command. Two notes guard against a false all-clear:

• Rate limited — more than half the answers were HTTP 429, so a result with no findings is not conclusive. Allow the scanner's address past your rate limit for a full run.
• Incomplete — the run hit its time limit; the note says how many requests were sent.

Limits Today

• One credential in one header per asset. Cookies, query-string keys and OAuth flows are not supported yet.
• GraphQL introspection checks are on the way; the sensitive-files scanner already flags an exposed GraphQL endpoint.