API types and specification formats

Invicti Enterprise offers API discovery and vulnerability testing on a single platform. API discovery is part of Invicti's API Security product that helps companies proactively address API-related risks by utilizing the Invicti DAST scanner to scan known and discovered API specs for vulnerabilities.

This document provides information about the API types and specification formats that Invicti Enterprise can discover and scan. 

API Discovery

Invicti Enterprise can discover the following API types and specification formats:

• REST APIs: OpenAPI3 and Swagger2 (the Mulesoft Anypoint Exchange integration can also discover RAML files)

After discovering your OpenAPI3 and Swagger2 specification files, you can easily link them to existing or new targets in Invicti Enterprise so they will be scanned for vulnerabilities the next time the linked target is scanned. For more information about API discovery and how it works in Invicti Enterprise, refer to API Discovery Overview.

API Scanning

Invicti Enterprise can scan the following API types and specification formats:

• REST APIs: OpenAPI3, Swagger2, RAML, WADL, Postman collection, and WordPress REST API
• SOAP: WSDL
• GraphQL: .graphql
• gRPC: protobuf

To scan any of these API files for vulnerabilities, you need to upload the file in the scan settings or link the URL if the file is hosted. For more information about API scanning, refer to Overview of Scanning APIs.