ApiPosture
Trusted by 4.2K+ developers

>_ Documentation

Get Started with ApiPosture

Installation, CLI reference, configuration, and CI/CD integration. Free & Pro editions.

Core CLI with AP001-AP008 free rules
# Install the free CLI
dotnet tool install -g ApiPosture
 
# Scan your API project
apiposture scan ./src/YourWebApi
 
✓ Scanned 47 files
✓ Found 156 endpoints
⚠ 3 critical findings

Quick Start

Pick your edition in the installer above. The scan command is identical across all runtimes.

ApiPosture uses Roslyn syntax-only parsing — no compilation, no NuGet packages required. Scans complete in under 2 seconds for most projects.

  • ✓ No compilation required — works with incomplete code
  • ✓ Fast — typical scans complete in under 2 seconds
  • ✓ No dependencies — doesn't need your NuGet packages

Scan your ASP.NET Core API project in seconds:

# Navigate to your project directory
cd ~/projects/MyWebApi
 
# Scan the API (Free — AP001–AP008)
apiposture scan ./src/MyWebApi
 
✓ Scanned 47 files
✓ Found 156 endpoints
⚠ 3 critical findings
⚠ 7 high severity findings

Or use Pro for OWASP Top 10 + secrets detection:

# Scan with Pro (includes free + pro rules)
apiposture-pro scan ./src/MyWebApi
 
✓ Scanned 47 files
✓ Found 156 endpoints
⚠ 3 critical findings
⚠ 7 high severity findings

CLI Reference

The scan command covers all analysis options.

scan

The primary command to analyse your API project.

apiposture scan <path> [options]

Arguments

  • <path> — Path to the directory containing your source files.

Options

Option Description Default
--output, -o Output format: terminal, json, markdown terminal
--fail-on Exit non-zero if severity found: critical, high, medium, low —
--exclude Glob patterns to exclude (repeatable) —
--config Path to config file (.json or .yaml) .apiposture.json
--framework Filter by framework: fastapi, flask, django_drf —
--no-color Disable coloured output false
--verbose, -v Show detailed output false

Examples

# Basic scan
apiposture scan ./src/Api
 
# Output as JSON
apiposture scan ./src/Api --output json
 
# Fail CI on high severity
apiposture scan ./src/Api --fail-on high
 
# Exclude test files
apiposture scan ./src --exclude "**/Tests/**"
 
# Save markdown report
apiposture scan ./src/Api --output markdown > report.md
 
# Java — using the JAR
java -jar apiposture.jar scan /path/to/project --fail-on high

Configuration

Create a .apiposture.json or .apiposture.yaml in your project root for persistent settings.

.NET / Node.js — JSON

{
  "exclude": [
    "**/Tests/**",
    "**/Migrations/**"
  ],
  "rules": {
    "AP005": { "maxRoles": 4 },
    "AP006": { "allowedGenericRoles": ["Admin"] },
    "AP007": { "sensitiveKeywords": ["admin", "debug", "secret"] }
  },
  "disabledRules": ["AP006"]
}

.NET / Node.js — YAML

rules:
  disabled:
    - AP006 # Disable weak role naming check
exclude:
  - "**/tests/**"
  - "**/migrations/**"
suppressions:
  - rule: AP001
    route: "/health"
    reason: "Health check is intentionally public"

Go — .apiposture.yaml

rules:
  enabled: [] # Empty = all rules
  disabled:
    - AP006
include:
  - "**/*.go"
exclude:
  - "**/vendor/**"
  - "**/*_test.go"
suppressions:
  - rule: AP001
    route: "/health.*"
    reason: "Health check is intentionally public"
min_severity: info

Java — .apiposture.yaml

rules:
  enabled: []
  disabled:
    - AP006
include:
  - "**/*.java"
exclude:
  - "**/build/**"
  - "**/target/**"
suppressions:
  - rule: AP001
    route: "/health.*"
    reason: "Health check is intentionally public"
min_severity: info

Configuration Options

  • exclude — Array of glob patterns to exclude from scanning
  • rules — Per-rule configuration overrides
  • disabledRules — Array of rule IDs to disable
  • suppressions — Per-route rule suppressions with reason
  • min_severity — Minimum severity level to report (Go / Java)

Output Formats

Three output modes to fit your workflow.

terminal

Terminal (Default)

Human-readable coloured output for local development.

json

JSON

Machine-readable output for tool integrations and scripts.

markdown

Markdown

Formatted report for documentation or PR comments.

apiposture scan ./src --output terminal
apiposture scan ./src --output json > results.json
apiposture scan ./src --output markdown > report.md

CI/CD Integration

Catch security issues before they reach production.

GitHub Actions

Runs on every push and pull request — blocks merges on critical findings.

View config

Azure DevOps

Integrates as a pipeline task using the DotNetCoreCLI installer.

View config

GitLab CI

Runs as a pipeline stage with artefact upload for scan reports.

View config

GitHub Actions

# .github/workflows/security.yml
name: API Security Scan
 
on: [push, pull_request]
 
jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0.x'
 
      - name: Install ApiPosture
        run: dotnet tool install -g ApiPosture
 
      - name: Run Security Scan
        run: apiposture scan ./src/Api --fail-on high
# .github/workflows/security.yml (Go)
- name: Run ApiPosture (Go)
  run: |
    go install github.com/BlagoCuljak/ApiPosture.Go/cmd/apiposture@latest
    apiposture scan . --fail-on high
# .github/workflows/security.yml (Java)
- name: Download ApiPosture
  run: |
    curl -L -o apiposture.jar https://github.com/BlagoCuljak/ApiPosture.Java/releases/latest/download/apiposture.jar
    java -jar apiposture.jar scan . --fail-on high --output json -f security-report.json

Azure DevOps

# azure-pipelines.yml
- task: DotNetCoreCLI@2
  displayName: 'Install ApiPosture'
  inputs:
    command: 'custom'
    custom: 'tool'
    arguments: 'install -g ApiPosture'
 
- script: apiposture scan ./src/Api --fail-on high
  displayName: 'API Security Scan'

GitLab CI

# .gitlab-ci.yml (.NET)
security-scan:
  image: mcr.microsoft.com/dotnet/sdk:8.0
  script:
    - dotnet tool install -g ApiPosture
    - export PATH="$PATH:$HOME/.dotnet/tools"
    - apiposture scan ./src/Api --fail-on high
# .gitlab-ci.yml (Java)
security-scan:
  image: openjdk:21
  script:
    - curl -L -o apiposture.jar https://github.com/BlagoCuljak/ApiPosture.Java/releases/latest/download/apiposture.jar
    - java -jar apiposture.jar scan . --output json --output-file apiposture-report.json
  artifacts:
    paths:
      - apiposture-report.json
# .gitlab-ci.yml (PHP)
security-scan:
  image: php:8.2-cli
  before_script:
    - curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
    - composer install
  script:
    - vendor/bin/apiposture scan ./app --fail-on high

Security Rules

ApiPosture Free includes 8 purpose-built rules. See the Features page for detailed explanations.

Rule Category Severity Description
AP001 Exposure HIGH Unintentional Public Access
AP002 Exposure HIGH Anonymous Write Operations
AP003 Consistency MEDIUM Authorization Conflicts
AP004 Consistency CRITICAL Missing Auth on Writes
AP005 Privilege LOW Role Sprawl
AP006 Privilege LOW Weak Role Names
AP007 Surface MEDIUM Sensitive Routes Exposed
AP008 Surface HIGH Minimal API Gaps
Pro Edition

Pro Installation

The Pro CLI includes all Free rules plus OWASP Top 10, secrets detection, diff mode, history tracking, and risk scoring. Your code never leaves your machine — all analysis runs 100% locally.

# Install the standalone Pro CLI
dotnet tool install --global ApiPosturePro
 
# Activate your license
apiposture-pro activate XXXX-XXXX-XXXX-XXXX
 
# Verify activation
apiposture-pro status

Java — Spring Boot (requires Java 11+)

Download the JAR and run directly — no installation required.

curl -L https://github.com/ApiPosture/ApiPosturePro.Java.Releases/releases/latest/download/apiposture-pro.jar -o apiposture-pro.jar
java -jar apiposture-pro.jar license activate XXXX-XXXX-XXXX-XXXX
java -jar apiposture-pro.jar license status

CI/CD — License via environment variable

No interactive activation needed in pipelines — set the key as a secret.

export APIPOSTURE_LICENSE_KEY=<your-jwt-token>

OWASP Top 10 Rules

Pro combines endpoint metadata analysis with deep source code inspection of method bodies — catching issues that surface analysis alone misses.

Rule Severity Description
AP101 CRITICAL Broken Access Control — missing auth middleware, DB writes without auth, IDOR, privilege escalation
AP102 HIGH Cryptographic Failures — weak hashing (MD5/SHA1), hardcoded crypto keys, sensitive data logging
AP103 CRITICAL Injection — SQL/command injection, unsafe deserialization, eval with user input, XSS
AP104 HIGH Insecure Design — missing CSRF protection, missing input validation, no rate limiting on auth endpoints
AP105 MEDIUM Security Misconfiguration — permissive CORS, XXE, debug endpoints, missing HTTPS/HSTS
AP106 MEDIUM Vulnerable Components — legacy API patterns, deprecated frameworks, EOL runtime versions
AP107 HIGH Authentication Failures — plaintext password comparison, missing audit logging on DELETE
AP108 HIGH SSRF — HTTP client with user-controlled input, unvalidated URL construction, open redirects

File-Level Scanning

Pro scans entire source files beyond just endpoint methods. Coverage varies by runtime:

  • Startup.cs / Program.cs — UseDeveloperExceptionPage without guard, missing HTTPS redirect, Swagger without env check
  • *.cshtml — @Html.Raw() XSS vulnerabilities, innerHTML assignments
  • *.cs — Reversible encryption in password context, hardcoded keys, BinaryFormatter
  • appsettings.json — AllowedHosts wildcard (*) host header injection risk
  • *.csproj — End-of-life .NET framework versions (below .NET 8.0)

Java (Spring Boot)

  • AP-F01 — *SecurityConfig*.java — .csrf(disable), .anyRequest().permitAll()
  • AP-F02 — **/*.java — Logging passwords, tokens, and secrets
  • AP-F03 — application*.properties/yml — Plaintext passwords, exposure.include=*, debug=true, H2 console
  • AP-F04 — pom.xml / build.gradle — Spring Boot 2.x (EOL), Java < 17

Secrets Detection

Detects 30+ secret patterns across source files and endpoint method bodies. Available on all runtimes — rule AP201 (.NET, Go, Java, Node.js) or AP014–AP015 (Python).

  • ● AWS, Azure, GCP cloud keys
  • ● GitHub, Slack, Stripe tokens
  • ● Database connection strings
  • ● Private keys and certificates
  • ● JWT secrets and API keys
  • ● Method bodies and all source files
# Secrets detection fires automatically during scan
apiposture-pro scan .
 
✖ [AP201] Critical: AWS Access Key detected in config.json
✖ [AP201] Critical: GitHub token found in AuthService.cs:42

Java: prefix each command with java -jar apiposture-pro.jar.

Diff Mode

Compare scans over time to track security improvements or regressions. Available on all runtimes.

# Save a baseline
apiposture-pro scan . --output json --output-file baseline.json
 
# ... make security improvements ...
 
# Scan again
apiposture-pro scan . --output json --output-file current.json
 
# Compare results
apiposture-pro diff baseline.json current.json
 
✓ 5 findings resolved
⚠ 2 new findings introduced

Python: use -f baseline.json instead of --output-file when scanning.

Java — Spring Boot

java -jar apiposture-pro.jar scan . --output json > baseline.json
java -jar apiposture-pro.jar scan . --output json > current.json
java -jar apiposture-pro.jar diff baseline.json current.json

History Tracking

Every scan is automatically saved to a local SQLite database at ~/.apiposture/history.db. No data leaves your machine. Available on all runtimes.

# View recent scans
apiposture-pro history list
 
# Show trend for a project
apiposture-pro history trend -p /path/to/project
 
# Show a specific scan
apiposture-pro history show <scan-id>
 
# Clean up old records
apiposture-pro history cleanup --days 90

Python: pass --with-history on each scan to opt in to history saving.

Java — Spring Boot

java -jar apiposture-pro.jar scan . --save-history
java -jar apiposture-pro.jar history list
java -jar apiposture-pro.jar history trend --path /path/to/project
java -jar apiposture-pro.jar history cleanup --days 90 --yes

Risk Scoring

Automated risk assessment aggregated across all findings. Available on all runtimes.

40%

Severity

Weight of critical/high/medium/low findings

25%

Exposure

Public-facing endpoints vs internal APIs

25%

Sensitivity

Data types handled — PII, auth, secrets

10%

Finding Density

Findings per endpoint scanned

apiposture-pro scan . --output json --output-file results.json
 
  Risk Score: 87 / 100 — CRITICAL
  Scanned 42 endpoints + 18 files in 2.3s

Java: use java -jar apiposture-pro.jar scan . --risk-score. Python: pass --no-risk-score to skip.

Enterprise License

Everything in Pro, plus enterprise-grade support and extensibility.

Pro

Pro License

  • ✓ OWASP Top 10 rules (AP101–AP108)
  • ✓ Secrets detection (AP201, 30+ patterns)
  • ✓ Diff mode — track regressions over time
  • ✓ Historical tracking with local SQLite
  • ✓ Risk scoring with four-factor model
  • ✓ Standard support
Enterprise

Enterprise

Enterprise License

  • ✓ All Pro features
  • ✓ SOC 2 / ISO 27001 compliance reports (PDF & HTML)
  • ✓ Compliance score + trend in scan output
  • ✓ Starter kits with policy file and CI/CD workflows
  • ✓ Policy enforcement (.apiposture-policy.json)
  • ✓ Tamper-evident audit trail export (JSON / PDF)
  • ✓ Operator attribution in findings and scan records
  • ✓ Integrity verification of scan records
  • ✓ Priority support with SLA
  • ✓ Custom rule development & site licenses

Interested in an Enterprise license?

Contact us to discuss site licensing, custom rules, and dedicated support.

Contact Sales

Questions or Feedback?

We're here to help you secure your APIs. Join our community or contact support.

CHAT WITH US VIEW DISCORD

Manage cookie preferences

Choose which optional cookies to allow. You can change this any time.