DOCSEARCHbyAlgolia
Submit Docs

APIsec Documentation

website·Indexed 34 days ago

https://dev-docs-apisecapps.apisec.ai/

Documentation for the APIsec platform, covering application onboarding, hosted agent deployment, and integrations with tools like Burp Suite, Mitmproxy, Postman, SwaggerHub, and various API gateways including AWS, Azure, Kong, Apigee, and MuleSoft. Includes guides for SSO configuration via Okta and Azure Entra, RBAC setup, and generating OWASP coverage reports.

Tokens
126.5K
Snippets
103
Records
1.2K
Agent score
45%

What's inside APIsec

  1. Overview of Apisec Apps platform

    Apisec Apps is an automated API security testing platform designed to identify vulnerabilities and improve the security posture of APIs. It is intended for use by developers, security professionals, and organizations.

  2. Overview of APIsec Security Policies

    Security Policies allow administrators to monitor and configure applications organization-wide to ensure they meet specific security standards. For example, a policy can be used to verify that all applications are scanned daily, providing a high-level view of which applications are non-compliant with expected security behaviors.

  3. Overview of Global Credentials

    Global Credentials provide a centralized way to manage authentication profiles that can be shared across multiple applications and application environments. Instead of maintaining separate credentials for each application, a single global credential can be linked wherever the same authentication configuration is required.

    Key benefits include:

    • Centralized Updates: Changes to a global credential are automatically applied to all linked applications and environments.
    • Simplified Rotation: Credential rotation is handled in one place.
    • Secure Access: Access is controlled via application-aware Role-Based Access Control (RBAC).

  4. Overview of APISec Hosted Agents

    A hosted agent is a lightweight component deployed within a customer's environment. It communicates with the APISec platform to perform API discovery, testing, and security scanning from inside the network boundary. This allows organizations to assess private APIs without exposing them to the public internet.

  5. Overview of APIsec Automated Security Testing

    APIsec is a fully automated API security testing platform designed to run thousands of test cases tailored to a specific API architecture. It integrates into development workflows to continuously identify security gaps and vulnerabilities, replacing slow manual testing processes to keep pace with continuous development cycles.

  6. Overview of Single Sign-On (SSO) in APIsec

    Single Sign-On (SSO) in APIsec allows users to authenticate once to gain access to the platform without re-entering credentials. This centralizes identity management, enhances security by enforcing corporate authentication policies, and improves user experience by eliminating multiple logins.

  7. Overview of API Authentication methods

    API authentication verifies the identity of a client or user before granting access to endpoints. Common methods include:

    • API Key: Uses a unique key, typically passed in request headers (e.g., Authorization: API_KEY).
    • OAuth 2.0: A token-based framework for third-party authentication and delegated permissions.
    • Bearer Token: Uses access tokens, often passed as Authorization: Bearer TOKEN.
    • HMAC (Hash-based Message Authentication Code): Uses cryptographic hashing to ensure request integrity and authenticity.
    • Certificate-Based: Uses SSL/TLS certificates for mutual identity verification, common in enterprise environments.

  8. Overview of API Authentication methods

    API authentication verifies the identity of a client or user before granting access to endpoints. Common methods include:

    • API Key: Uses a unique key, typically passed in request headers (e.g., Authorization: API_KEY).
    • OAuth 2.0: A token-based framework for third-party authentication and delegated permissions.
    • Bearer Token: Uses access tokens, often passed as Authorization: Bearer TOKEN.
    • HMAC (Hash-based Message Authentication Code): Uses cryptographic hashing to ensure request integrity and authenticity.
    • Certificate-Based: Uses SSL/TLS certificates for mutual identity verification, common in enterprise environments.

  9. Overview of Scan Scheduling

    The Schedule Scans feature automates security scans at regular intervals (daily, weekly, or monthly). Scheduled scans run automatically using a pre-configured authentication method, scan profile, and hosted agent to ensure consistent security coverage.

  10. Overview of SSO integration with APIsec

    Single Sign-On (SSO) allows users to access APIsec using a single set of credentials managed by a centralized identity provider. This integration enhances security by enforcing centralized authentication policies, improves user experience by eliminating multiple logins, and ensures enterprise compliance.

  11. Overview of APIsec Integrations

    APIsec integrates with API gateways, collaboration tools, and issue tracking systems to automate security testing, manage vulnerabilities, and embed security into CI/CD pipelines. These integrations allow teams to analyze traffic, detect misconfigurations, and receive real-time notifications without manual effort.

  12. Overview of Code Bolt

    Code Bolt is an APIsec tool that analyzes application source code to automatically generate an OpenAPI specification. This specification lists API endpoints, HTTP methods, parameters, and request/response schemas, which APIsec then uses to perform security scans.