Viewing and configuring API endpoints - Port Swigger
Summary: PortSwigger's documentation describes how Burp Suite DAST populates an Endpoints tab from an uploaded API definition file, showing request name, HTTP method, SOAP operation, host, path and query, and content type. It states that all endpoints are selected for scanning by default except requests for static assets in HAR files, and that selections are retained for requests present in both versions when a Burp XML file changes.
What's compelling: Because every endpoint in an uploaded definition is scanned by default, the scope of a DAST scan is set by what the API definition contains - and the documentation notes Burp Suite DAST can only scan endpoints that meet its requirements for scanning.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026