API security scanning

Declaring APIs

APIs are first-class assets, not just another hostname. Add a REST or GraphQL endpoint, then authenticate with bearer tokens, API keys, basic auth or cookies. Credentials are encrypted at rest (AES-256-GCM) and never displayed after save.

OpenAPI and GraphQL

• Upload an OpenAPI/Swagger spec or point Vertix at its URL — ZAP scans every documented operation
• GraphQL introspection detection plus dedicated GraphQL scan support
• Coverage reports show which operations were exercised

Safe mode

Destructive HTTP methods (DELETE, PUT, PATCH) are auto-excluded on production-looking endpoints by default. Add per-endpoint path exclusions for anything sensitive. Safe mode is the default — you opt out explicitly for staging environments.