API Endpoint Safety Checker

Anyone can unpack a published app or open browser dev tools and read the API endpoints it calls. Paste your endpoint list or route definitions to see which designs attackers tend to go for first: exposed debug and admin paths, guessable IDs, secrets in URLs, file-path parameters and more.

About this tool

Paste a list of API endpoints or route definitions and the checker looks for designs that make an API easy to attack once its endpoints are known: debug and admin paths that are reachable, sequential numeric IDs that invite insecure direct object reference (IDOR) attacks, keys and tokens in the query string, file-path and URL parameters (path traversal and server-side request forgery), plain HTTP, private IP addresses and GraphQL introspection. Each finding lists the lines it came from.

The check is plain text pattern matching in your browser. Nothing you paste is sent to a server, so unpublished API specifications are safe to use. Secret values in URLs are masked in the output.

How it works

• Input: one endpoint per line, for example GET /api/v1/users/12345 or a full URL. A line can have an HTTP method in front. Route definitions work too, as long as the path text is on the line.
• Danger: debug or admin style paths (/debug, /admin, /internal, /console, /actuator, /swagger, /api-docs, /openapi, /metrics, /phpinfo, /.env, /.git, /h2-console, /phpmyadmin); parameters named key, api_key, apikey, token, access_token, password or secret with a value; and plain http:// to any host other than localhost.
• Caution: a purely numeric ID right after users, orders, accounts, invoices, documents, files, payments or items; parameters named file, path, filename or filepath; parameters named url, uri, redirect, redirect_uri, next, callback or dest whose value starts with http; a GET request whose path contains delete, remove, reset or drop; and addresses in the private ranges 10.x.x.x, 172.16–31.x.x and 192.168.x.x.
• Info: a GraphQL endpoint, with a reminder to disable introspection in production. A green note is shown for a check that found nothing in the debug and admin group.
• The tool cannot see your code. It does not know whether an endpoint requires authentication, checks ownership of an ID, or validates a path. A finding means “look at this”, and no finding does not mean the API is secure.

FAQ