DAST

Scanning APIs

• Last updated: September 17, 2025

• Read time: 3 Minutes

This section explains how to create sites to scan specific APIs in Burp Suite DAST. To scan an API, you need to provide an API definition and any required authentication.

Adding API definitions

You can add API definitions by uploading a file or providing a URL. The supported formats are:

• Postman Collection
• OpenAPI definition file in JSON or YAML format
• SOAP WSDL

For Postman Collections, you can also upload a Postman environment file to automatically merge environment variables with your collection. This removes the need to manually merge variables and speeds up your setup process.

You can also scan GraphQL APIs, using introspection. To scan a GraphQL API, create a site for a web app and provide the URL for the GraphQL API. Make sure introspection is switched on. For more information, see Crawling GraphQL APIs.

Adding API definitions by uploading a file

When you upload an API definition file, Burp Suite DAST uses that version for every scan until you upload a new one.

To add an API definition by uploading a file:

1. Go to Sites and select Add a new site.

2. Select API from the Site type panel.

3. Enter a unique Site name.

4. To add the site to an existing folder, select from the Site folder drop-down menu. Leave the field blank to create the site at the top level of the site tree.

5. Click Select file and select the definition file to upload.

6. If you upload a Postman Collection, you are given the option to upload a Postman environment file. Burp Suite DAST merges the environment variables with your Postman Collection. Click Add environment file and select your environment file.

Adding API definitions by providing a URL

When you provide a URL, Burp Suite DAST uses the latest version of the API definition for every scan. You can validate that the URL is reachable and the file can be parsed.

To add an API definition by providing a URL:

1. Go to Sites and select Add a new site.

2. Select API from the Site type panel.

3. Enter a unique Site name.

4. To add the site to an existing folder, select from the Site folder drop-down. Leave the field blank to create the site at the top level of the site tree.

5. Click Host URL and enter the URL where your API definition file is hosted.
6. Click Validate to confirm that Burp Suite DAST can reach the URL and parse the API definition. If successful, the Endpoints tab lists the parsed endpoints.

Managing authentication for API sites

When you add an API definition, Burp Suite DAST automatically detects authentication schemes. You don't have to provide credentials immediately.

To add authentication credentials after creating a site:

1. Go to Sites and select your API site.

2. Select the Details tab and click Edit.

3. Under API definition, select the Authentication tab. Add any credentials that are shown as missing.

4. Click Save.

Optional settings for your API

When you add a new API site, you can configure the following additional settings:

• Scan configuration

• Connections

• Headers and cookies

• Extensions

• Scanning pool

• Notifications

For more information on configuring the optional settings for your API, see Configuring site settings.

Saving and scanning your site

Once you've finished creating your site, click Save.

Burp Suite DAST adds the new API to the site tree and prompts you to schedule a scan.