Research Academy
My account Customers About Blog Careers Legal Contact Resellers

DAST

Scanning APIs

  • Last updated: August 28, 2025

  • Read time: 3 Minutes

This section explains how to create sites to scan specific APIs in Burp Suite DAST. To scan an API, you need to provide an API definition and any required authentication.

Note

You can add as many APIs as you like to Burp Suite DAST but for scans to work correctly, you need to configure your network and firewall settings. For more information, see Configuring network and firewall settings for a site.

Adding API definitions

You can add API definitions by uploading a file or providing a URL. The supported formats are:

  • Postman Collection
  • OpenAPI definition file in JSON or YAML format
  • SOAP WSDL

You can also scan GraphQL APIs, using introspection. To scan a GraphQL API, create a site for a web app and provide the URL for the GraphQL API. Make sure introspection is switched on. For more information, see Crawling GraphQL APIs.

Note

While many OpenAPI 3.1.x definitions can be scanned successfully, those that include specific 3.1.x features may not be supported. For best compatibility, we recommend using definitions that align closely with OpenAPI 3.0 standards.

Adding API definitions by uploading a file

When you upload an API definition file, Burp Suite DAST uses that version for every scan until you upload a new one.

To add an API definition by uploading a file:

  1. Go to Sites and select Add a new site.

  2. Select API from the Site type panel.

  3. Enter a unique Site name.

  4. To add the site to an existing folder, select from the Site folder drop-down menu. Leave the field blank to create the site at the top level of the site tree.

  5. Click Select file and select the definition file to upload.

Adding API definitions by providing a URL

When you provide a URL, Burp Suite DAST uses the latest version of the API definition for every scan. You can validate that the URL is reachable and the file can be parsed.

To add an API definition by providing a URL:

  1. Go to Sites and select Add a new site.

  2. Select API from the Site type panel.

  3. Enter a unique Site name.

  4. To add the site to an existing folder, select from the Site folder drop-down. Leave the field blank to create the site at the top level of the site tree.

  5. Click Host URL and enter the URL where your API definition file is hosted.
  6. Click Validate to confirm that Burp Suite DAST can reach the URL and parse the API definition. If successful, the Endpoints tab lists the parsed endpoints.

Note

If you provide a URL for a Postman Collection, Burp Suite DAST also extracts the credentials for detected authentication schemes. They are shown in the Authentication tab.

If you manually edit the credentials for your site, they may be overwritten if you later click Validate.

Managing authentication for API sites

When you add an API definition, Burp Suite DAST automatically detects authentication schemes. You don't have to provide credentials immediately.

To add authentication credentials after creating a site:

  1. Go to Sites and select your API site.

  2. Select the Details tab and click Edit.

  3. Under API definition, select the Authentication tab. Add any credentials that are shown as missing.

  4. Click Save.

Optional settings for your API

When you add a new API site, you can configure the following additional settings:

  • Scan configuration

  • Connections

  • Headers and cookies

  • Extensions

  • Scanning pool

  • Notifications

For more information on configuring the optional settings for your API, see Configuring site settings.

Saving and scanning your site

Once you've finished creating your site, click Save.

Burp Suite DAST adds the new API to the site tree and prompts you to schedule a scan.

Related pages