API Security Checker
See what an API endpoint tells an anonymous caller.
What this tool does
What anonymous callers see
Whether an unauthenticated request is refused or answered with data, and whether errors leak stack traces.
Headers that suit an API
HSTS, nosniff, content type and cache control on authenticated responses — not a demand for CSP on a JSON endpoint.
Specification discovery
Checks the conventional paths where APIs publish OpenAPI documents, since a public spec describes everything you have.
Observation, not attack
One ordinary request. No injection, no authorization testing, no measuring rate limits by exhausting them.
Frequently asked questions
What exactly does this send?
One ordinary GET request with an Origin header, exactly as a browser would make. It reads the status, headers and body shape. It does not attempt authorization bypass, injection, or anything else a normal client would not do.
Why does it not test for vulnerabilities like injection?
Because that is attacking a target, and a tool anyone can point at any URL should not do it. Active testing needs credentials, a defined scope and permission from the owner. What is here is what a visitor could observe anyway, organised so it is useful.
Why does it not measure the rate limit?
Finding a rate limit by exhausting it is a denial of service with a friendly name. Limits are detected from the RateLimit headers when a server advertises them, and the report says plainly that it cannot rule out limiting it did not see.
My endpoint returned data without authentication. Is that bad?
It depends entirely on intent, which is why it is flagged rather than failed. A public API is supposed to answer anonymous callers. What matters is whether this particular endpoint was meant to — and if it was not, how long it has been open.
Why does it not ask for a Content-Security-Policy?
Because CSP restricts what a document may load, and a JSON endpoint is not a document. Demanding it on an API is the kind of advice that trains people to ignore reports. What does matter is nosniff, correct content types, HSTS and cache control on authenticated responses.
What is specification discovery?
A check of the conventional locations where APIs publish their OpenAPI document — /openapi.json, /swagger.json, /v3/api-docs and a few more. Finding one is not automatically a problem, but a public specification for an internal API describes your whole surface area to anyone who looks.
Monitor it, don't just check it
One-off checks catch what is broken today. CertNotify watches your certificates, domains, DNS and code continuously and tells you before something breaks.