API overview - Port Swigger

Summary: Burp Suite DAST provides two APIs for interacting with the system from third-party software: a GraphQL API, which PortSwigger recommends for new integrations and describes as offering the broadest range of functionality, and a REST API, positioned as a simple migration path for users familiar with the Burp Suite Professional API. Using either API requires setting up an API user, each with a unique API key for authentication, and the same role-based permissions that apply to UI users limit what an API user can do.
What you should know: API users inherit the same role-based access control as UI users, so an API key issued with overly broad permissions carries that same reach into any third-party software that holds it.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026