Api Scanner
Fast, accurate and free online api scanner tool running directly in your browser.
-
1Enter data
Enter content, paste text or load a file from disk. -
2Click the button
The tool will immediately process your data in the browser. -
3Get the result
Copy the finished text or save the file to your device.
return "Result ready in 0.1s";
}
API Security Scanner
Run a quick, non-invasive API scan (REST or GraphQL) for common issues: missing authorization, simple XSS/SQLi vulnerabilities (error-based), exposed error messages, and potential SSRF points. This tool is intended only for testing systems you are authorized to test.
No significant issues were detected based on the tests performed. This is only a quick, superficial scan and does not replace a full security audit.
Rate this tool:
Related tools
Other tools you may find usefulAPI Scanner in Webp - quick security reconnaissance of REST and GraphQL APIs
API Scanner in the Webp toolkit is a lightweight, non-invasive API scanner that allows you to check in a few moments how the selected REST or GraphQL endpoint behaves, what HTTP headers it returns, whether it correctly handles authorization and whether it shows any typical symptoms vulnerabilities such as reflected XSS, error based SQL injection or potential SSRF points, without the need to install specialized software on your computer.
Instead of manually building requests in the console, copying curl from the documentation and adding parameters blindly, you can paste the endpoint address in API Scanner in Webp, select the API type, HTTP method, headers and possible bodies, select the security modules you are interested in, click the scan button and after a while you will get a clear report that shows how your server responds, where error messages appear and which configuration elements require refinements.
What Webp's API Scanner does and when to use it
Webp's API Scanner is designed to be a practical API security scanner that doesn't pretend to be a full-blown vulnerability exploit tool, but helps you quickly detect common configuration issues, mishandling of HTTP headers, debug messages left in production, and simple symptoms related to injections in query parameters or heuristic signs of potential SSRF, which makes it a great first step before more advanced testing.
Key uses of API Scanner
- Pre-test the security of REST API or GraphQL just before connecting a mobile application, SPA frontend or integration with partners.
- A quick review of endpoints after deploying a new backend version to check for unwanted error messages, stack traces, or overly detailed environment information.
- Controlling the configuration of HTTP headers for the API, including security, cache, CORS and basic elements affecting data exposure.
- A simple endpoint authorization test that allows you to compare API behavior with and without Authorization headers, which helps catch cases of incorrect permission enforcement.
- Reconnaissance of query parameters for simple XSS or SQLi injections and identification of parameter names that may act as potential SSRF sinks, such as url, callback, target or endpoint.
Who is the API scanner intended for
- For backend developers who want to quickly see after implementation how their API responds to unusual requests and whether HTTP headers comply with security recommendations.
- For DevOps engineers and administrators who are looking for a lightweight browser-based tool to quickly check endpoint configurations without opening additional applications.
- For product owners and people responsible for integrations who want the API shared with partners not to reveal unnecessary information about the production environment.
- For people learning API security who want to understand basic problems in practice, in their own testing environment, without having to use heavy penetration testing tools.
How to use Webp's Scanner API step by step
Webp's Scanner API is based on a single, clean form, so you can complete your first scan in seconds while maintaining control over request parameters, headers, bodies, and security modules to run.
- In theEndpoint API (URL)field, paste the full address of the endpoint you want to check, for example the address of the REST resource or the address of the GraphQL endpoint used by your application.
- You select theAPI type(REST or GraphQL) and theHTTP methodthat your endpoint uses, thanks to which the scanner prepares an appropriate request tailored to the operation of a given interface.
- In theHTTP Headerssection, you can add line by line all the headers that your frontend or integration client normally sends, for example Authorization with the Bearer token, headers identifying the application, or API keys.
- If your endpoint requires a request body, you fill in theRequest Bodyfield in JSON or any other format your API expects, which allows you to recreate a typical production scenario.
- TheFollow redirectsoption allows you to decide whether the scanner should follow 3xx responses, which is useful for endpoints that redirect to other paths or domains.
- You set arequest timeoutso that API Scanner does not wait forever for a server response, especially when you are testing a busy environment or an address that may be temporarily unavailable.
- Finally, you select the security modules you want to run and click the start scan button, after which the tool makes a series of controlled requests and generates a report of the results.
API Scanner modules - what exactly do they check
Webp's API Scanner consists of several modules that focus on different aspects of API security, from basic authentication, through lightweight injection tests, to SSRF heuristics and debug message detection, so you can tailor the scope of your scan to your current needs and avoid unnecessary tests.
Authorization Module - Authorization Headers Test
TheLightweight Authorization Testoption allows API Scanner to make two requests, one with the provided authorization headers and the other without them, to verify that the endpoint is consistently enforcing the required permissions and not returning the same data to anonymous clients.
- Compares the response codes and headers for a request with and without authorization headers.
- Helps detect situations where the endpoint returns too much information even in the absence of a valid token.
- Gives a quick signal whether the API protection mechanism is accidentally configured on only part of the HTTP path or method.
HTTP Headers and API Response Module
Each API scan generates a summary of the HTTP response, including the status code, headers, final address after redirection, and a shortened content preview, which allows you to detect missing security headers, unnecessarily disclosed server information, and other details that may be important from a security point of view.
- Shows the raw HTTP headers returned by the endpoint, so you can easily check whether the configuration is consistent with company policy.
- Makes it easier to identify headers that reveal details about technology or software versions that you may want to hide.
- It presents a fragment of the response body, which helps you spot debug messages or other content that should not reach the client.
XSS and SQLi Tests in Query Parameters
If you enablesimple injection test, API Scanner will add special test values to the selected query parameter to see if the marker appears raw in the response or if the application generates known SQL error messages, which is a lightweight, controlled way to catch potential validation of input data.
- Watches for whether a test parameter is reflected in the response body without appropriate HTML or JSON context encoding.
- Looks for database error signatures typical of popular engines in the response, which may indicate a problem with the query.
- Clearly emphasizes that these are first-level tests that should be followed up with deeper analysis and reporting to the security team.
SSRF Heuristics and Debug Messages
The SSRF Heuristics and Debug module helps you identify parameters that may accept URLs or hosts to connect to, as well as spot error messages, stack listings, or other pieces of text that suggest misconfiguration in your production environment, which is very useful when you want to tidy up the exposure of your API before making it available to a wider audience.
- Parses parameter names to detect fields that can be used to point to external or internal addresses.
- Looks for signatures of common debug messages and development configurations that should not be active in production.
- Adds found items to the report as potential areas for review, encouraging technical people to review them.
How to read the API Scanner report and what to do with the results
Once a scan is complete, Webp's API Scanner displays an HTTP summary, a table of detected issues, and details for each module, allowing you to quickly decide which items require immediate attention and which can be scheduled as tasks for the next sprint.
| Report element | What does | mean How can you use it |
|---|---|---|
| HTTP summary | Information about the response status, final address, headers and basic technical parameters of the API response. | Allows you to immediately check whether the endpoint is working, what headers it returns and whether it does not perform unexpected redirects. |
| Problem list | Summary of detected observations with assigned category, module and estimated significance. | Can be used as a task list for developers, DevOps and people responsible for organizing API configurations. |
| Authorization Module | Comparison of responses with and without authorization headers, along with conclusions about authorization consequences. | If the answers are very similar, it is a sign that it is worth checking the permissions policies and security configuration more closely. |
| XSS / SQLi Tests | Information about whether the test marker appeared in the response without encoding and whether database error messages occurred. | Helps you decide whether you need to extend your tests to more advanced scenarios and introduce additional input validations. |
| SSRF heuristics and debug | A list of parameter names and messages that may indicate a potential SSRF sink or mis configuration of the environment. | Provides a starting point for reviewing configuration, disabling debug modes, and tidying up how API errors are reported. |
FAQs about API Scanner in Webp
Is API Scanner a safe tool for my environment
API Scanner in Webp makes controlled HTTP requests to a specified endpoint, using the configuration you set in the form, so it behaves similarly to a typical client using your API, but with additional test markers that help detect symptoms of potential security problems. The tool does not perform aggressive attacks and is intended as a light reconnaissance, not a full penetration test.
Is API Scanner a replacement for a professional API security audit
No, API Scanner does not replace a full security audit or comprehensive penetration testing, but it is a very useful initial layer that helps detect obvious configuration problems, the presence of debug messages or authorization inconsistencies, thanks to which the security team already has pre-organized information about where to look next.
Can I scan any API found on the web
Good security practices and ethics clearly state that tests should only be conducted on systems to which you have access rights or formal consent to reconnaissance, therefore API Scanner in Webp should be used primarily to analyze your own services, test and production environments for which you are responsible in your organization.
How often should I run API Scanner on my endpoints
Many teams treat API Scanner as part of their internal checklist, running it after each major backend change, after migrating to a new environment, and before initiating key integrations with partners, which helps reduce the risk of revealing unwanted information and catch basic configuration issues faster.
What to do if API Scanner detects potential problems
It is worth sending the API Scanner report to developers, DevOps and security people to jointly review individual modules, correct the header configuration, debug modes and parameter validation, and then, if necessary, order more advanced tests using dedicated tools and test scenarios.
Run API Scanner in Webp and check how your API reacts to basic security tests
If you want to quickly see what headers your API returns, how authorization works, whether query parameters are handled correctly and whether any debug messages appear in the response content, use API Scanner in Webp, paste the endpoint address, select the type of tests and let the tool prepare a clear report that will become the foundation for further organizing and organizing activities. improving the security of your services.
Run API Scanner in Webp and perform the first security reconnaissance of your API