Using ScanSuite
Web API scans
Scanning an API from its OpenAPI specification.
To run an API scan, specify the URL path to the OpenAPI specification and choose the API Scan engine. It parses the specification and executes the scan against the discovered routes and parameters.
Both cookies and an Authorization header are supported by this scan, so authenticated API surface is actually tested rather than skipped.
Point the target at the specification document itself, not the API root. If the specification requires authentication to fetch, supply the same header you would use for the API — see Web App Scanning for where authentication goes.
Last reviewed 2026-08-16