> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aiptx.io/llms.txt
> Use this file to discover all available pages before exploring further.

# API Scanning

> Advanced API security testing for REST, GraphQL, and gRPC

# API Scanning

AIPTx provides comprehensive API security testing for modern API architectures.

## REST API Testing

### OpenAPI/Swagger Integration

```yaml theme={null}
api:
  type: rest
  spec: ./openapi.yaml
  # or remote
  spec: https://api.example.com/openapi.json
```

### Custom Endpoints

```yaml theme={null}
api:
  endpoints:
    - method: GET
      path: /api/users/{id}
      params:
        id: ["1", "2", "999", "admin"]

    - method: POST
      path: /api/users
      body:
        name: "{{fuzz}}"
        email: "{{fuzz}}@test.com"
        role: ["user", "admin"]
```

## GraphQL Testing

```yaml theme={null}
api:
  type: graphql
  endpoint: https://api.example.com/graphql
  introspection: true

  queries:
    - |
      query {
        user(id: "{{fuzz}}") {
          email
          role
        }
      }

  mutations:
    - |
      mutation {
        updateUser(id: "{{fuzz}}", role: "admin") {
          success
        }
      }

  tests:
    - introspection_enabled
    - query_depth_limit
    - batch_query_attack
    - field_authorization
```

## gRPC Testing

```yaml theme={null}
api:
  type: grpc
  endpoint: api.example.com:443
  proto_files:
    - ./protos/service.proto
  reflection: true
```

## API Security Tests

| Test                  | Description                 |
| --------------------- | --------------------------- |
| Authentication bypass | Missing or weak auth        |
| Authorization flaws   | IDOR, privilege escalation  |
| Input validation      | Injection, overflow         |
| Rate limiting         | DoS protection              |
| Data exposure         | Sensitive data in responses |

## Response Analysis

```yaml theme={null}
api:
  response_analysis:
    sensitive_data:
      - password
      - secret
      - token
      - ssn
      - credit_card
    pii_detection: true
    verbose_errors: true
```