scan.now
Premium Scan a site

Discover Public API Endpoints and OpenAPI Documents

Enter a site page. Scan.now inventories same-origin API hints in its links and scripts, then checks standard OpenAPI document locations without calling business operations.

Enter the exact public page to inspect. No form is submitted and no data is modified.

A registered account is required to run this test. Finding status, evidence, affected locations and remediation are Premium-only. How active scanning works · Acceptable use

Build an external inventory before judging API security

Teams cannot secure endpoints they do not know are public. Old API versions, generated documentation and routes referenced only in JavaScript frequently remain reachable after the main application has moved on.

Scan.now inventories same-origin API hints from page links, inline code and a bounded set of same-origin scripts. It also checks four standard OpenAPI document locations and, when a valid document is public, records its declared version and route count. Discovered business operations are not called.

Put this result in context

This scanner answers one part of the review. Continue with GraphQL Scanner for discover graphql endpoints and request schema metadata, then Error Disclosure for detect exposed runtime exceptions and stack traces. These are separate checks because a strong result here does not prove that the adjacent surface is healthy.

For the background behind these signals, read Website Security: What a Vulnerability Scan Looks For and How to Fix It and What Is a Vulnerability Scan? Types, Limits and What the Results Mean. The API and OpenAPI surface inventory check reference explains the exact test, evidence and remediation used in the report. The Scan.now methodology explains request limits, scan boundaries and what the scanner deliberately does not attempt.

Routes, scripts and OpenAPI documents reviewed

The check is deliberately bounded to the signals below.

Coverage areaWhat the scanner examines
Client-visible route hintsReferences beginning with API, REST, GraphQL or versioned route patterns are resolved back to the same origin.
OpenAPI locationsA bounded list of common openapi.json and swagger.json paths is requested and content-validated before inclusion.
Inventory, not exploitationMethods are not enumerated by sending requests and no discovered create, update or delete operation is invoked.

Reading the external endpoint inventory

A scan result is evidence with a boundary, not a guarantee about every route.

Routes discovered

Compare the external list with the owned API catalogue. Unknown, obsolete and undocumented entries deserve an owner and retirement decision.

OpenAPI document public

Review whether the schema is intentionally public, current and free of internal hosts, examples, descriptions or operations that should remain private.

No route hint

The sampled page and standard locations exposed no recognisable API reference. Runtime requests, mobile APIs and unlinked endpoints may still exist.

Reduce exposure and govern published interfaces

Use the recommendations below to address confirmed findings and strengthen the surrounding control.

  1. Maintain one API catalogue

    Record owner, purpose, environment, data classification, authentication and retirement date for every externally reachable service.

  2. Remove retired versions

    Disable routes at the gateway and origin; hiding documentation while leaving the endpoint reachable does not retire it.

  3. Protect schemas deliberately

    Publish documentation intentionally, or require authentication and strip internal servers, examples and administrative operations.

  4. Enforce controls at the gateway and service

    Authentication, authorisation, schema validation, rate limits and logging should not depend on the frontend behaving correctly.

  5. Compare deployments continuously

    Diff gateway routes and generated OpenAPI documents against the approved catalogue during release and monitoring.

How it works

  1. Enter an application page

    Use a page that loads the frontend or links to the API documentation you want inventoried.

  2. Public hints and schemas are collected

    Same-origin scripts, links and four standard OpenAPI locations are inspected within strict request and size limits.

  3. Reconcile with the owned catalogue

    The result is an external attack-surface list, not a claim that every listed endpoint is vulnerable.

What this tool checks

1 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

Exposed files and information disclosure

1 check

The ones that most often decide the grade:

Info API and OpenAPI surface inventoryAPI route hints and public OpenAPI documents discovered from the page and well-known locations.

Related tools

Continue the review with four checks that cover adjacent parts of the same attack surface.

All tools
Active Security GraphQL Introspection Scanner

Discover GraphQL endpoints and request schema metadata
Active Security Error Disclosure Scanner

Detect exposed runtime exceptions and stack traces
Active Security SQL Injection Vulnerability Scanner

Discover GET inputs and reproduce SQL indicators
Websites Website Vulnerability Scanner

Headers, TLS, cookies, exposed files

Guides for this tool

Background reading written to go with these results.

13 min read · Updated Sep 13, 2026 Website Security: What a Vulnerability Scan Looks For and How to Fix It

A website vulnerability scan checks the parts of a site an attacker can reach without logging in: Transport security, HTTP headers,...

Read the guide
8 min read · Updated Sep 12, 2026 What Is a Vulnerability Scan? Types, Limits and What the Results Mean

A vulnerability scan checks a system against a list of known weaknesses and reports what matches. The types of scan, the difference...

Read the guide
8 min read · Updated Sep 14, 2026 Passive vs Active Scanning: What Each Can Find and When Each Is Appropriate

Passive scanning observes normal responses; active scanning sends crafted requests to trigger flaws. The boundary, why it matters...

Read the guide
9 min read · Updated Sep 18, 2026 How to Read a Security Scan Report: Severity, False Positives and What to Fix First

A scan report is a list of findings with severities, and the hard part is deciding what matters. How severities are assigned, how to...

Read the guide

Frequently asked questions

Is a public OpenAPI document a vulnerability?

Not automatically. Public APIs often publish excellent documentation. The risk is accidental disclosure, obsolete operations or assuming hidden documentation is an access control.

Does the scanner call discovered API operations?

No. It inventories references and validates OpenAPI documents, but does not invoke business endpoints or mutate data.

Why can the inventory be incomplete?

A single page may not load every feature. Runtime URL construction, mobile clients, separate API hostnames and legacy routes may never appear in its source.

What should I do with an unknown endpoint?

Identify the owning service from gateway and deployment records, determine whether it handles real traffic, then secure, document or retire it with monitoring in place.