code.apiAPI definition and server configuration
Checks OpenAPI/Swagger files (missing or weak authentication, HTTP servers, secrets in query strings, unbounded lists, mass assignment) and heuristically flags risky GraphQL server settings and unthrottled Express login routes. Tagged with OWASP API Security Top 10 (2023) ids.
- Engine
- Built-in
- Targets
- Codebase
- Areas
- Security, Best practices
- Runs
- By default, when the target applies
- Network
- Only the target itself
Run only this auditor
bunx openaudit . --only code.apiBuilt into openaudit; nothing to install.