API scanning FAQs - Port Swigger
Summary: PortSwigger's FAQ on API scanning with Burp Suite Professional and DAST documents how the scanner parses API definitions, noting that OpenAPI 3.2 support is provisional and that GraphQL is scanned through live endpoint introspection rather than a file upload. It lists the schema patterns that cause Burp to drop operations from coverage, including object-typed header parameters, composition schemas on headers, and bare primitive request bodies, and caps schema recursion at four levels.
What you should know: Every dropped operation is an endpoint that never gets tested, and the FAQ attributes most of them to three schema patterns that teams often generate without noticing, such as FastAPI's Optional[str] producing an anyOf header schema. A scan that reports clean while silently skipping those operations gives a security leader false assurance about the exact APIs exposed to attackers.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026