Drop in a Swagger / OpenAPI spec and map an API’s attack surface in your browser — missing auth, BOLA candidates, mass-assignment and a ready-to-run curl collection.
swagger.json / openapi.json file here, or paste above.100% in-browser — the spec never leaves your device. YAML isn't parsed here; convert it to JSON first (most tools export JSON, or use the JSON Workbench).
OpenAPI / Swagger Analyzer reads the spec the developers already wrote and turns it into a security review. Every endpoint, every parameter, every request body is checked against the patterns that drive the OWASP API Top 10 — and the output is a graded findings list plus a curl collection you can paste straight into Burp.
Parsing happens entirely in your browser — paste the JSON or drop a swagger.json file and nothing is uploaded. There is no token cost, no rate limit, no sign-in required.
It supports OpenAPI 3.x and Swagger 2.0. YAML is not parsed in-browser today; export your spec as JSON first (every modern editor does) or run it through the JSON Workbench.
security requirement (high for writes, medium for reads). The classic “they forgot a decorator” bug.id, uuid, userId, accountId and friends. Test ownership, not just the token.role, isAdmin, price, owner, permission and other privileged-looking fields.additionalProperties: true on request bodies (undocumented fields accepted = wider attack surface).?api_key= leak into logs, history, referrers and proxies.http:// server in the servers block.This one is free in your browser. Sign up for server-side recon, scan history, and projects.
Create free account Sign inNo. Analysis is 100% in-browser. The spec never leaves your device, and no curl from the “Request collection” tab fires until you copy it into your own terminal.
Convert it to JSON first. Most editors export JSON directly; if not, paste the YAML into the JSON Workbench tool here, switch to YAML→JSON, and feed the output back into this tool. We may add native YAML parsing later — feedback welcome.
The tool reads the spec, not the live API. If the spec is missing the security requirement on an operation, that’s a documentation drift bug worth fixing — and worth probing, because servers sometimes drift too.
BOLA is fundamentally a runtime check (“does the server verify object ownership?”). A spec can only tell you which endpoints are obvious candidates. Use the generated curl with two different users’ tokens to confirm.