Cybersecurity · free, no signup
API Security Posture Analyzer
Paste an OpenAPI 3.x or Swagger 2.0 specification to see what the API documents about its own security: operations callable without credentials, API keys carried in query strings, plain-HTTP servers, and legacy OAuth flows. It also maps every operation that addresses an object by identifier — the surface where broken object-level authorization lives — and is explicit that a specification can never show whether that check exists. The result is a test plan, not a verdict.
Authorized, defensive use only. Check assets you own or lawfully public data. This tool is educational and never provides another party's private data.
Paste an OpenAPI 3.x or Swagger 2.0 specification as JSON. The API itself is never contacted — only the document is read, and it is not stored.
The result is best read as a test plan. A specification shows where authorization must hold; only a request can show whether it does, and the operations that address objects by identifier are listed for exactly that reason.
What happens to what you enter
- The analysis runs on Solvex servers. What is recorded afterwards is a SHA-256 hash of your input and a coarse summary of the outcome — never the input itself, and never a result you could be identified from.
- Tools that read public sources (certificate logs, DNS, a public chain) contact those sources from our servers through a fetcher that refuses private and internal addresses.
- An email address is stored only where a tool offers to send you a report and you choose to give one.
Limits: ten runs of this tool per minute from one address, and three signed reports per minute. Past that the tool says so and tells you when to try again.
When a free check is not enough
This tool reads what is public and reports what it can see. The API Penetration Testing engagement is the authorized, specialist-led version: signed scope, findings proven by hand, a signed report, and a retest.
Explore API Penetration Testing