Requirements for API scanning - Port Swigger
Summary: PortSwigger's Burp Scanner can scan APIs by parsing uploaded definitions or definitions found during crawling, covering OpenAPI (JSON or YAML), SOAP WSDLs, Postman Collections in v2.1.0 format, and GraphQL APIs with introspection enabled. Each format carries parsing conditions - no external references, reachable server URLs, absolute URLs when uploaded from a file - and endpoints Burp cannot scan are logged in the event log.
Bottom line: API definitions expose endpoints, parameters, and authentication details that ordinary crawling may never reach, so an organization that only scans rendered web pages is leaving that attack surface unaudited. The format-specific limits - Postman requests with file, formdata, or graphql bodies cannot be scanned, and GraphQL requires introspection to be enabled - mean coverage gaps can persist silently unless someone reads the event log.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026