Scan using an OpenAPI specification file
You can use an OpenAPI specification file to automatically scan your OpenAPI, which provides better coverage by allowing you to update parameters and include all endpoints. This ensures a more thorough and accurate scan, helping to identify potential issues across the entire API.
Procedure
- Go to Configuration > API.
- Select OpenAPI specification file and click Add specification file.
-
Enter the URL or click Browse to choose the file from your local
drive, then click Continue. AppScan accepts only JSON or YAML
formats for the specification file.
AppScan parses the data and loads it into the table of Additional Parameters.
- Configure the base URL if not automatically populated.
-
AppScan automatically detects parameters' values during explore, but you can manually
update parameters for better performance in cases where the value cannot be detected
automatically during scan. Edit the parameter values by matching them with their relevant
URLs.
It is strongly recommended to update the parameters for better scan coverage, ensuring all endpoints are covered and avoiding request failures.
-
Configure API authentication if required. Based on your specification file,
Configure API key and/or Configure basic
authentication (HTTP) links are displayed to configure authentication. If
the links are not displayed, you can manually configure the authentication through API key, HTTP Authentication, or Login Management (record login or use automatic
login) that ensures better scan coverage covering most endpoints and avoiding request
failures.
If AppScan does not use the parameter values you updated, you can:
- Select the Apply this value to all parameters checkbox in the Edit Parameter dialog.
- To avoid exceeding rate limit failures during exploration, adjust the Max. request rate in the Communication and proxy tab.
-
Once configuration is complete, you can start a scan.
AppScan starts an automatic scan.Note: If you add a local file instead of a URL to a configuration, you cannot export it as a SCANT (template) file, as the specification file cannot be included in a template. You must either remove the specification file or save as a SCAN file.