# API scan

> Scan captured API traffic for likely IDOR, mass assignment, missing rate limits, weak JWTs, CORS and request-smuggling signals, with evidence. Nothing is sent.

Source: https://docs.subcloak.com/cloak-proxy/insights/api-scan/

Added in Cloak Proxy 0.5.1.

The **API Scan** tab reads the API traffic Cloak Proxy already captured and flags the security problems that most often turn up in a review: a user reading another user's object (IDOR), a client setting a field it shouldn't (mass assignment), an endpoint with no rate limit, an error page that leaks a stack trace, a weak JSON Web Token, a loose CORS rule, a missing header, or a request-smuggling signal. Every check is **passive** — it reads the captured requests and responses and sends nothing. There is no scanning, no probing and no replay, so it is safe to run on any traffic you have captured.

For the checks that need a real request to confirm — an IDOR especially — Cloak Proxy hands you off to the [Authorization Matrix](https://docs.subcloak.com/cloak-proxy/testing/authorization-matrix/), which replays the endpoint as another identity, only against systems you choose to test.

*[Screenshot: The API Scan tab: category chips across the top (All, BOLA / IDOR, Mass assignment, Rate limiting, Verbose errors, Sensitive data, Headers & cookies, CORS, JWT, Desync risk) with BOLA / IDOR selected. The top finding is a medium 'Object addressed by id behind a login' on GET api.example.com/v1/orders/{id}, expanded to show the ids seen, a fix and a 'Confirm in Authorization Matrix' button.. Findings are grouped by category and sorted worst first. Expand one for its evidence, a fix, and the tool that confirms it.]*

> **Passive by design:**
> Nothing in this tab sends a request. To actually confirm a finding you move to a tool that sends traffic — the Authorization Matrix for an IDOR — and that tool only touches the hosts you put in scope and asks before it runs.

## Open it

1. Capture some API traffic. The more endpoints and the more objects you touch while signed in, the more the scan has to work with.
2. Open Insights with <kbd>⌥</kbd> <kbd>⌘</kbd> <kbd>I</kbd> and click **API Scan**.
3. To scan only your target, pick **In scope** in the **Analyze** menu at the top of Insights (it appears once a [target scope](https://docs.subcloak.com/cloak-proxy/security/scope/) is active). Filter by category with the chips, or by severity with the severity menu. Click **Details** on a finding for its full explanation, evidence and fix.
4. Use **Show Requests** to select the requests behind a finding in the main window, **Confirm in Authorization Matrix** where it's offered, or **Add to Findings** to add it to an engagement report.

If no API traffic has been captured, the tab says **No API-security findings**. Hosts reached through an undecrypted HTTPS tunnel aren't scanned — turn on [SSL Proxying](https://docs.subcloak.com/cloak-proxy/capture/ssl-proxying/) for them first.

## What it checks

| Category | What it flags | OWASP API |
|---|---|---|
| **BOLA / IDOR** | An object addressed by id (`/orders/{id}`) read behind a login, especially when the ids run in sequence. A candidate, not a confirmed bug — confirm it in the Authorization Matrix. | API1:2023 |
| **Mass assignment** | A write (`POST`/`PUT`/`PATCH`) whose body sets a privileged field — `role`, `is_admin`, `verified`, `balance`, an owner id — more so when the response echoes it back. | API3:2023 |
| **Rate limiting** | A busy endpoint, or a login, token or reset endpoint, whose responses never carry a `RateLimit` header or a `429`. A passive signal: the server may limit without advertising it. | API4:2023 |
| **Verbose errors** | An error response that leaked a stack trace, a database error or a debug page (Python tracebacks, Java and .NET stack traces, SQL errors, PHP and Rails errors, Flask and Whoops debug pages). | API8:2023 |
| **Sensitive data** | An API key, token, private key or card number returned **in a response**. (Secrets your client *sends* stay in the [Secrets](https://docs.subcloak.com/cloak-proxy/insights/secrets/) tab.) | API3:2023 |
| **Headers & cookies / CORS** | Missing security headers, weak cookie flags and risky CORS — the same checks as the [Security](https://docs.subcloak.com/cloak-proxy/insights/security/) tab, shown here per finding so the whole scan is in one place. | API8:2023 |
| **JWT** | A token in use with `alg: none`, no expiry, or a very long lifetime. For every token and sign-in flow in detail, use [Tokens and sign-in](https://docs.subcloak.com/cloak-proxy/security/tokens-and-sign-in/); this raises only what's obvious from the token. | API2:2023 |
| **GraphQL** | A GraphQL endpoint that answered an introspection query with its full schema in production, or accepted a large batch of operations (10 or more in one request) or a deeply nested query (8 levels or more) — ways to multiply what one request costs and get around rate limits. | API9:2023, API4:2023 |
| **Desync risk** | HTTP request-smuggling signals: a message with both `Content-Length` and `Transfer-Encoding`, conflicting length headers, an odd `Transfer-Encoding`, or a front end whose `Via` header shows it forwards over HTTP/1.1 (an HTTP/2-to-HTTP/1.1 downgrade). | API8:2023 |

Each finding carries a severity, the evidence that triggered it (masked ids, a one-line snippet, the offending headers), a plain-language fix, and the request ids behind it.

## Desync risk (request smuggling)

Front ends that downgrade HTTP/2 to HTTP/1.1 are a common source of parser-discrepancy bugs, and conflicting length headers are the classic setup for request smuggling. The **Desync risk** category flags those signals in the headers Cloak Proxy captured:

- **Both length headers on one message** (`Content-Length` and `Transfer-Encoding`) — high. Two servers in the chain can disagree about where the body ends.
- **Conflicting or duplicate `Content-Length`** headers.
- **An unusual `Transfer-Encoding`**, such as `chunked, chunked` or `xchunked` — a common obfuscation.
- **A front end that forwards over HTTP/1.1** — low. A CDN or load balancer whose `Via` header shows an HTTP/1.x hop (for example `Via: 1.1 varnish`) downgrades requests if it accepts HTTP/2 from clients. This is an architecture signal, not a vulnerability on its own.

It does no active probing; it points at a message worth a closer look. The background is PortSwigger's [HTTP/1.1 must die](https://portswigger.net/research/http1-must-die).

> **Why the HTTP version alone isn't used:**
> Cloak Proxy answers each client in the client's own protocol, so it records a response under the client's HTTP version, not the server's. A downgrade can't be read from the recorded version, so the scan relies on the server's own `Via` header instead.

## Add a finding to a report

Expand a finding and click **Add to Findings** to send it to an engagement report, with its severity, evidence, the OWASP and CWE references, the affected endpoint and the backing requests filled in. See [Findings and reports](https://docs.subcloak.com/cloak-proxy/security/findings/).

## From the MCP server

The same scan is available to AI assistants as the read-only **`api_scan`** tool: it returns the findings with their category, severity, evidence, fix, OWASP id and request ids, and takes a `category`, `min_severity`, `format` (`summary` or `markdown`) and `in_scope` (only requests in the active [target scope](https://docs.subcloak.com/cloak-proxy/security/scope/)). It sends nothing. See the [MCP tools reference](https://docs.subcloak.com/cloak-proxy/automation/mcp-tools-reference/).

> **On Linux:**
> (added in Cloak Proxy 0.5.1) The Linux app's Insights window has no API Scan tab yet. Use the `api_scan` MCP tool.

## Related

  - [Authorization Matrix](https://docs.subcloak.com/cloak-proxy/testing/authorization-matrix/): Confirm an IDOR candidate by replaying the endpoint as another identity.
  - [Security](https://docs.subcloak.com/cloak-proxy/insights/security/): Per-host A–F grades for headers, cookies and CORS.
  - [Secrets](https://docs.subcloak.com/cloak-proxy/insights/secrets/): Keys, tokens and card numbers in captured traffic.
  - [Findings and reports](https://docs.subcloak.com/cloak-proxy/security/findings/): Collect findings into an engagement report.