The fix, in one snippet
GET /openapi.json -> reviewed current routes onlyIllustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
Scan.now reads links, inline JavaScript and a fixed list of OpenAPI locations, then records same-origin endpoints and the number of documented paths.
Why it matters
Unowned and obsolete endpoints commonly miss current authentication, validation, patches and monitoring.
How to fix it
Maintain one route inventory, remove old versions, require authentication consistently and keep production documentation intentional.
Where this fits
API and OpenAPI surface inventory is check 15 of 18 that the api surface scanner runs under exposed files and information disclosure, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits WordPress version disclosure (low), where the site runs WordPress and reveals its exact core version through the generator tag, asset query strings, readme.html or the feed, letting attackers match it against known core vulnerabilities. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
API and OpenAPI surface inventory closes one route in. Immediately below it: Redirect parameters on the page, where links or forms on the page carry parameters whose names and values suggest a redirect target (next=, return_to=, url=); robots.txt review, where a review of robots.txt; security.txt (RFC 9116) present, where no security.txt file was found at /.well-known/security.txt, or the one present is invalid or expired.
Found in the same scan
The api surface scanner reports this alongside checks from other categories that are at least as serious, including SQL injection, where a GET parameter produced a repeatable database-error or boolean-response SQL injection indicator, and Server-side request forgery, where a URL-like parameter caused the verified server to request a unique Scan.now callback. A single run of api surface scanner answers all of them at once.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: API and OpenAPI surface inventory (info severity)
Scanner check id: api-surface-inventoryThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
