# API Scanning

{% hint style="warning" %}
For deeper testing of APIs and web apps, including OWASP risks like SQL injection plus logic flaws, IDOR and cross-tenant data leaks, use **Agentic Scan** instead. The REST and GraphQL scanners below are still supported, but Agentic Scan is the recommended option. See [Aikido Pentest](https://help.aikidogov.us/pentests/aikido-pentest).
{% endhint %}

{% content-ref url="rest-api-scanning.md" %}
[rest-api-scanning.md](https://help.aikidogov.us/dast-surface-monitoring/api-scanning/rest-api-scanning)
{% endcontent-ref %}

{% content-ref url="graphql-api-scanning.md" %}
[graphql-api-scanning.md](https://help.aikidogov.us/dast-surface-monitoring/api-scanning/graphql-api-scanning)
{% endcontent-ref %}

{% content-ref url="authenticated-api-scanning-for-rest-graphql.md" %}
[authenticated-api-scanning-for-rest-graphql.md](https://help.aikidogov.us/dast-surface-monitoring/api-scanning/authenticated-api-scanning-for-rest-graphql)
{% endcontent-ref %}

{% content-ref url="../../pentests/coverage-and-findings/what-issues-can-aikido-pentest-find/understanding-and-detecting-idor-vulnerabilities.md" %}
[understanding-and-detecting-idor-vulnerabilities.md](https://help.aikidogov.us/pentests/coverage-and-findings/what-issues-can-aikido-pentest-find/understanding-and-detecting-idor-vulnerabilities)
{% endcontent-ref %}

{% content-ref url="ignoring-routes-in-api-scanning.md" %}
[ignoring-routes-in-api-scanning.md](https://help.aikidogov.us/dast-surface-monitoring/api-scanning/ignoring-routes-in-api-scanning)
{% endcontent-ref %}