Getting Started with ApiShield

Comprehensive API security scanning for your applications.

ApiShield is a security scanner for APIs that follows a Pipe and Filter architectural pattern. It decouples the source of API definitions (OpenAPI, Postman, HAR, or Live URLs) from the security analysis logic.

Data Flow

Ingestion: Detects the input type and invokes the corresponding parser.
Normalization: Parsers convert the input into a standardized internal representation (based on OpenAPI 3.0).
Scanning: Iterates through the normalized definition to identify vulnerabilities.
Reporting: Maps findings to the STRIDE threat model and OWASP API Top 10.

Core Modules

Module	Purpose	Key Functions
`index.js`	CLI Entry point & orchestration	`main()`, `detectInputType()`
`lib/normalizer.js`	Core scanning engine and sensitive data patterns	`scanSpec()`, `normalizeSpec()`, `findSensitiveFields()`
`lib/config.js`	Configuration management and merging	`loadConfig()`
`lib/reporters/threatModel.js`	Risk reporting and STRIDE mapping	`generateThreatModel()`

Supported Parsers

openapi.js: Standardizes existing OpenAPI specifications.
postman.js: Extracts endpoints and schemas from Postman Collections.
har.js: Infers API structure and data types from HTTP Archive files.
live.js: Probes live endpoints and performs dynamic schema inference from responses.

Next Steps

Rate Limiting - Performance considerations
Threat Models - Security audit details

PreviousSocial Recon NextRate Limiting

Was this helpful?