This release lets you scan APIs from Burp XML and HAR files, and makes it clearer which URL to enter for a GraphQL API.
Scan APIs from Burp XML and HAR files
You can now create an API site from a Burp XML file, saved using Save items in Burp Suite, or from a HAR file, such as one exported from your browser. Upload the file on its own or as part of a bulk upload, or fetch it from a URL.
Each request in the file becomes an endpoint that you can review and enable or disable, in the same way as Postman requests. When you upload a HAR file, static assets such as images, stylesheets, scripts, and fonts are disabled by default.
API Finder also recognizes Burp XML and HAR files. You can review them, apply them to a site, and keep them in sync. Static assets found during sync stay disabled.
See authentication schemes by name
When you add an OpenAPI, Postman, or GraphQL definition, Burp Suite DAST now lists each authentication scheme it declares by name, including schemes that aren't supported for scanning yet, such as Digest, NTLM, and AWS Signature Version 4.
OAuth 2.0 authorization code and implicit flows, and OpenID Connect, now take a bearer token, so you can scan these APIs by supplying a token. Existing sites keep their saved authentication.
Clearer GraphQL errors
If you enter a URL that serves a GraphQL schema written in SDL, rather than the GraphQL endpoint itself, you now see a message asking for the endpoint URL so that Burp Suite DAST can fetch the schema by introspection.
If API Finder reports a GraphQL schema, it now explains that you can scan the API by adding a site with the URL of its GraphQL endpoint.