API Scanning

For deeper testing of APIs and web apps, including OWASP risks like SQL injection plus logic flaws, IDOR and cross-tenant data leaks, use Agentic Scan instead. The REST and GraphQL scanners below are still supported, but Agentic Scan is the recommended option. See Aikido Pentest.

REST API & Web App Scanning GraphQL API Scanning Authenticated API Scanning for REST/GraphQL Detecting IDOR Vulnerabilities Ignoring Routes in API Scanning