DOCSEARCHbyAlgolia
Submit Docs

APIsec Documentation

website·Indexed 31 days ago

https://docs.apisecapps.com/

A platform offering automated API security testing solutions designed to identify vulnerabilities. Documentation covers API security scanning, vulnerability analysis, SSO configuration (Okta, Azure Entra, Ping Identity), and integrations with AWS, MuleSoft, Apigee, Jira, and Mitmproxy.

Tokens
63.7K
Snippets
57
Records
602
Agent score
49%

What's inside APIsec

  1. Overview of API Authentication methods

    API authentication verifies a client's identity before granting access to endpoints. Common methods include:

    • API Key: A unique key typically passed in request headers (e.g., Authorization: API_KEY).
    • OAuth 2.0: A token-based framework for third-party authentication and delegated permissions.
    • Bearer Token: Access tokens used in headers (e.g., Authorization: Bearer TOKEN), common in web and mobile apps.
    • HMAC (Hash-based Message Authentication Code): Uses cryptographic hashing to ensure request integrity and authenticity.
    • Certificate-Based: Uses SSL/TLS certificates for mutual authentication, typically in enterprise environments.

  2. Overview of APIsec Integrations

    APIsec integrates with API gateways, collaboration tools, and issue tracking systems to automate security testing and streamline API protection. These integrations allow teams to:

    • Automate security testing at the gateway level.
    • Receive real-time notifications on vulnerabilities.
    • Create automated issue tracking for faster remediation.
    • Embed API security within CI/CD pipelines.

  3. Overview of APIsec Security Testing

    APIsec allows users to automatically run thousands of API security tests on their APIs. The platform provides a guided onboarding process including UI orientation, application onboarding, and the configuration of authenticated scans to identify vulnerabilities such as BOLA (Broken Object Level Authorization).

  4. Overview of SSO integration with APIsec

    Single Sign-On (SSO) allows users to access APIsec using a single set of credentials managed by a centralized identity provider. This integration enhances security by enforcing centralized authentication policies, improves user experience by eliminating multiple logins, and ensures enterprise compliance.

  5. Overview of Global Credentials

    Global Credentials provide a centralized way to manage authentication profiles that can be shared across multiple applications and application environments. This eliminates the need to maintain separate credentials for each application. Key benefits include:

    • Centralized Management: Update authentication details in one place to automatically apply changes to all linked applications.
    • Consistency: Reduces administrative overhead and configuration inconsistencies.
    • Security: Access is controlled via application-aware Role-Based Access Control (RBAC).

  6. Overview of APIsec Security Policies

    Security Policies allow administrators to monitor and configure applications organization-wide to ensure they meet specific security expectations. For example, a policy can be used to verify that all applications are scanned daily, providing a high-level view of which applications are not behaving as expected.

  7. Overview of Code Bolt OpenAPI generation

    Code Bolt is a tool by APIsec that analyzes application source code to automatically generate an OpenAPI specification. This specification lists API endpoints, HTTP methods, parameters, and request/response schemas, which APIsec then uses to perform security scans.

  8. Overview of APIsec Security Testing

    APIsec allows users to automatically run thousands of API security tests on their APIs to identify vulnerabilities. The platform provides a guided onboarding process covering UI navigation, application onboarding, security coverage analysis, and vulnerability management.

  9. Overview of APIsec Automated Security Testing

    APIsec is a fully automated API security testing platform designed to run thousands of test cases tailored to a specific API architecture without manual effort. It integrates into development workflows to continuously identify security gaps, vulnerabilities, and risk levels (Critical, High, Medium, and Low) to prevent exploitation by attackers.

  10. Overview of the App Model workflow for API security

    The App Model is a step-by-step workflow designed to progressively increase API test coverage. Instead of a single scan, it guides users through incremental configurations to ensure security and functional validation are completed methodically. This approach allows users to start with minimal setup and systematically expand security coverage to identify vulnerabilities in a controlled sequence.

  11. Analyze API security posture using the Executive Summary

    The Executive Summary provides a high-level snapshot of security and scanning posture via four key sections:

    • Overview: Aggregated counts of onboarded applications, discovered endpoints, executed scans, and unresolved vulnerabilities for a specific month, Business Unit, and Team.
    • Vulnerability Age Matrix: Categorizes open vulnerabilities by severity (Critical, High, Medium, Low) and age (e.g., <30, 30-60, 60-90, 90+ days). Clicking a cell opens a detailed Vulnerability Breakdown panel.
    • Open Vulnerabilities Trend: A 6-month trend chart showing the total number of unresolved vulnerabilities by severity at the end of each month.
    • Vulnerability Resolution Trend: A 6-month trend chart showing the total number of resolved vulnerabilities by severity at the end of each month.

  12. Understand API Spec Analysis

    APIsec automatically reviews API specifications (OpenAPI, Postman Collection, GraphQL, etc.) from a security perspective before any scans are executed. This analysis identifies what the platform understands about the API, missing elements in the spec, and necessary configurations required before scanning. Gaps in the spec are treated as configuration gaps that may hinder testing accuracy rather than confirmed vulnerabilities.