Scan an OpenAPI, SOAP, or GraphQL API with OWASP ZAP

zap-api-scan points OWASP ZAP at an API definition instead of a browsable site. Feed it an OpenAPI or Swagger spec, a SOAP description, or a GraphQL schema, and it imports every operation, then exercises each one with ZAP's active and passive rules. That coverage matters for APIs, where there is no HTML to crawl and endpoints exist only in the contract.

The -f flag tells ZAP which kind of definition it is reading, and -t takes either a local file or a remote URL such as an openapi.json or a /graphql endpoint. Safe mode (-S) skips the active attack and runs a baseline pass instead, -l and -s control how much of the report you see, and a -c config file marks specific warnings as INFO, IGNORE, or FAIL so a scan can pass or break a build on your terms.

On Trickest, zap-api-scan is a Scanners node that reads an API definition and writes a report file and a folder of results. Run it as dynamic application security testing in a CI-style workflow against a freshly deployed API, or schedule it so every spec change is retested and findings land where the rest of your security results are triaged.