API Scanning

For deeper testing of APIs and web apps, including OWASP risks like SQL injection plus logic flaws, IDOR and cross-tenant data leaks, use Agentic Scan instead. The REST and GraphQL scanners below are still supported, but Agentic Scan is the recommended option. See Aikido Pentest.

REST API & Web App ScanningGraphQL API ScanningAuthenticated API Scanning for REST/GraphQLDetecting IDOR VulnerabilitiesIgnoring Routes in API Scanning