English

GraphQL API Scanning

Agentic Scan is the recommended option for testing GraphQL APIs. It covers fuzzing-style checks plus business-logic flaws, IDOR and cross-tenant data leaks that the GraphQL scanner cannot find. See Aikido Pentest.

Aikido can scan your GraphQL API endpoints to uncover endpoint vulnerabilities specifically related to GraphQL. One of the methods we use is API fuzzing, which essentially includes spamming dangerous payloads to each field in your API.

NEVER run on a production environment, always on staging to avoid potential downtime

Main Use Cases

You can see all checks in the Aikido app here.

Setting up GraphQL API Scanning

Step 1: Click Add Domain in the Domain Overview, expand Advanced in the scan-type chooser and select GraphQL

Choose scan type modal with the Advanced section expanded showing REST API and GraphQL options.

Step 2. Enter the domain name of your staging environment. Ensure this is the base URL for your GraphQL APIs (e.g., https://example.io/graphql)

Input field for entering a GraphQL endpoint domain name.

Step 3: Click save, Aikido will now scan your GraphQL API.

Step 4. Authorization: Note that you can also add authorization information if this is required to talk to your API. You can do this by clicking the triple dots action menu on the domain, and then 'Authenticate Domain'

Domain action menu offering scan, configuration, authentication, and delete options.

This will trigger the modal where you can fill in the authentication details. For the full list of supported authentication methods, see Authenticated API Scanning for REST/GraphQL.

Domain authentication setup form for enabling form-based login credentials.

Identifying Aikido traffic

All requests coming from Aikido REST and GraphQL scans will have: