API Scanning Is Here: Decloak Now Finds and Tests Your REST, GraphQL, and SOAP Endpoints
A page-level scan tells you a lot about what a browser loads. It tells you much less about what happens behind the scenes, the REST endpoints, the GraphQL schema, the internal API your frontend calls that was never meant to be public but is reachable anyway. That gap is closed now. API scanning is live on Decloak Enterprise, part of Active Security Testing, and it runs automatically on every Enterprise agent scan under the same consent flag as the rest of Active Testing.
Four ways it finds your APIs
Rather than relying on one detection method, four discovery approaches run together:
- OpenAPI/Swagger. Checks common spec paths and follows links from documentation pages like Swagger UI or ReDoc, parsing both JSON and YAML formats.
- GraphQL introspection. Sends a safe, read-only introspection query against common GraphQL paths. If introspection is left enabled, that's flagged as a finding on its own, it hands anyone a full schema map of your API. It escalates further if that schema exposes mutations named things like
delete,admin,password, orpayment, the kind of naming that tells an attacker exactly where to look first. - SOAP/WSDL. Checks common WSDL definition paths and extracts the operations a service exposes.
- Undocumented endpoints. A common-path wordlist combined with a scraper that reads your site's own JavaScript for
fetch,axios, andXMLHttpRequestcalls, surfacing same-origin API paths that were never documented anywhere but are still being called by your own frontend.
What happens once an endpoint is found
Every discovered endpoint gets light, non-destructive active testing: a heuristic check for unauthenticated access to anything that looks sensitive, plus CORS misconfiguration and reflected-input (XSS-shape) checks. Testing is capped at 20 endpoints per scan, with documented sources (the ones found via OpenAPI, GraphQL, or WSDL) tested before undocumented ones.
Deliberately, there's no parameter fuzzing and no exploitation attempts here, same conservative philosophy as the rest of Active Testing. The goal is finding real, unambiguous issues safely, not stress-testing your production API. Findings from API scanning blend into your existing Active Testing score rather than producing a separate number to track.
Why we built it
Both AppCheck and Intruder, the closest competitors doing structured DAST and attack-surface work, run proper API discovery and testing rather than spot-checking a handful of known endpoints. This had already been flagged internally as a gap before competitive research independently confirmed it, converting a known deferred item into a shipped feature.
Building it also caught a real bug in the process: our original fixed-path OpenAPI discovery missed a genuine Swagger spec sitting at a non-conventional, query-string-based URL. The fix, following embedded links from documentation pages rather than only guessing standard paths, is now how discovery works across the board, which makes it more reliable for the sites that don't put their spec somewhere predictable.
Availability
Live now on Decloak Enterprise, running automatically as part of every Active Security Testing scan.
API endpoint discovery and testing is available on Decloak Enterprise as part of Active Security Testing. See plans →