Coding custom integrations with GraphQL API - Port Swigger

Summary: PortSwigger documented how Burp Suite DAST users can push API definitions into API finder through its GraphQL API when no built-in connector exists, covering OpenAPI and SOAP WSDL definitions and Postman Collections. Built-in connectors are provided for Amazon API Gateway, Azure API Management, and Google Apigee; custom integrations require creating an API user, adding it to the API Uploaders group, and writing a script that reuses the same unique_id to update rather than duplicate an API.
Bottom line: Every API definition pushed through a custom integration depends on an API user placed in the API Uploaders group, so the access granted to that account and the unique_id discipline in the script determine whether your API inventory stays accurate or quietly fills with duplicates.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026