# How to Scan an API from an OpenAPI, Swagger, or Postman Spec

Canonical: https://vulnify.app/blog/how-to-scan-api-from-openapi-spec

Import OpenAPI, Swagger, or Postman into Vulnify. Review the spec, send read-only GET checks, and open the report. Later scans use 18 credits.

An API spec is a map. It says which paths exist, which ones expect a token, and which ones take an id. A website scanner that starts at the homepage will not read that map. Vulnify’s API spec scan imports OpenAPI 3, Swagger 2, or a Postman collection, reviews the spec, and can send read-only GET requests to the host the spec names. The dashboard is the place to run it. The public URL /api-spec-scan exists and is marked noindex. Use the dashboard so the report lands on the account that paid for it. Import the spec Paste JSON or YAML, or give a spec URL. Pasted content wins if both are filled in. A spec fetched by URL is limited to 500 KB. The optional base URL is taken from the spec’s servers or host when you leave it blank. Override it when the spec still points at a vendor example host and you mean to test your own. The label “Run live endpoint checks” means safe read-only GETs. No mutating requests are sent. POST, PUT, PATCH, and DELETE stay in the spec review. They are not called. “Include headless crawl enrichment” is a separate option. The preview is free and stops at 20 pages. The line under the form is: “API Spec Scan costs 18 credits per run. Headless Crawl Preview is free.” If the account still has the API spec trial, the first scan is free. If the trial is already used, the scan costs 18 credits. Quote whichever sentence the screen shows. Do not assume the trial is still available. What the spec review flags before any request Missing endpoint-level auth is high, unless the path includes /public . A GET with an {id} parameter is a BOLA candidate, severity medium: the spec alone cannot prove the object is authorized. A non-GET path under /admin is a privileged mutation, severity high, and it is spec-only. The scanner does not send that mutation. Placeholders are dull on purpose. An id parameter becomes 1 . Anything else becomes test . Probes stay on the declared host. They do not follow the spec onto a different domain. Auth on the live checks If you attach a profile, the types for this scan are bearer, API key header, and OAuth client credentials. A saved profile is created under Scan Authentication Profiles, the same card used for website scans. Live results you should expect to see named: A protected endpoint that returns 2xx without auth is high. If the spec says there is no security, but the live call returns 401 or 403, the finding is downgraded to low. The spec was wrong in the safer direction. A rejected auth profile is info. Fix the profile before you treat the rest of the run as authenticated. No rate limit after 12 rapid GETs, with no 429, is medium. A pet store spec and a private admin API A public example spec is a safe way to see the form. Paste the YAML, leave live checks on if you are willing to send GET requests to the host written in that spec, and read the static findings first. A GET with {id} is a medium BOLA candidate even when you never send the request. The id used in a live GET is 1 , not a guess at someone else’s identifier. Other parameters become the literal test . A private admin API is the opposite case. Turn live checks on only against a host you operate. Paths under /admin that are not GET are flagged high as privileged mutations and are not called. A path that includes /public is spared the missing-auth high finding. Do not rename a private path to contain /public to silence the finding. Fix the security scheme in the spec, or accept that the endpoint is intentionally open and say so in the ticket. If pasted YAML and a URL are both filled, the paste is what gets scanned. A 500 KB URL that fails to fetch does not silently fall through to a stale paste you forgot was there. Clear the field you do not mean. If the spec’s servers entry is still the vendor’s example host, set the base URL to yours before you enable live checks. Probes do not wander off the declared host. Headless crawl enrichment is optional and free, capped at 20 pages. Use it when the API is documented by a site you also want listed. It is not the API scan. The 18 credits, or the trial if the screen still offers it, apply to the spec scan. The preview does not. Open the report The report is the list of those findings plus the endpoints the spec declared. Later scans are 18 credits each. A website scan of the marketing site is a different credit charge and a different article, how to scan a website for vulnerabilities . Use this one when the thing you need to test is the API contract. Frequently asked questions Are POST and DELETE sent? No. Live checks are GET only. Mutating methods are reviewed from the spec and are not requested. What does the first scan cost? If the API spec trial is still available on the account, the first scan is free. Otherwise it costs 18 credits. Headless crawl preview is free either way, up to 20 pages. What does a downgraded auth finding mean? The spec did not declare security, and the live GET returned 401 or 403. The finding drops to low because the endpoint refused the unauthenticated call.