openauditB85out of 100: openaudit's audit of itself
web.api-exposure

Exposed API surface

Looks for public OpenAPI/Swagger documents, Swagger UI, GraphQL introspection and OpenID discovery with a handful of GET requests, ignoring catch-all pages that answer 200 everywhere.

Engine
Built-in
Targets
URL
Areas
Security
Runs
By default, when the target applies
Network
Only the target itself

Run only this auditor

bunx openaudit https://example.com --only web.api-exposure

Built into openaudit; nothing to install.