API scan

The API Scan tab reads the API traffic Cloak Proxy already captured and flags the security problems that most often turn up in a review: a user reading another user’s object (IDOR), a client setting a field it shouldn’t (mass assignment), an endpoint with no rate limit, an error page that leaks a stack trace, a weak JSON Web Token, a loose CORS rule, a missing header, or a request-smuggling signal. Every check is passive — it reads the captured requests and responses and sends nothing. There is no scanning, no probing and no replay, so it is safe to run on any traffic you have captured.

For the checks that need a real request to confirm — an IDOR especially — Cloak Proxy hands you off to the Authorization Matrix, which replays the endpoint as another identity, only against systems you choose to test.

Findings are grouped by category and sorted worst first. Expand one for its evidence, a fix, and the tool that confirms it.

×

Passive by design

Nothing in this tab sends a request. To actually confirm a finding you move to a tool that sends traffic — the Authorization Matrix for an IDOR — and that tool only touches the hosts you put in scope and asks before it runs.

Open it

1. Capture some API traffic. The more endpoints and the more objects you touch while signed in, the more the scan has to work with.
2. Open Insights with ⌥ ⌘ I and click API Scan.
3. To scan only your target, pick In scope in the Analyze menu at the top of Insights (it appears once a target scope is active). Filter by category with the chips, or by severity with the severity menu. Click Details on a finding for its full explanation, evidence and fix.
4. Use Show Requests to select the requests behind a finding in the main window, Confirm in Authorization Matrix where it’s offered, or Add to Findings to add it to an engagement report.

If no API traffic has been captured, the tab says No API-security findings. Hosts reached through an undecrypted HTTPS tunnel aren’t scanned — turn on SSL Proxying for them first.

What it checks

Category	What it flags	OWASP API
BOLA / IDOR	An object addressed by id (/orders/{id}) read behind a login, especially when the ids run in sequence. A candidate, not a confirmed bug — confirm it in the Authorization Matrix.	API1:2023
Mass assignment	A write (POST/PUT/PATCH) whose body sets a privileged field — role, is_admin, verified, balance, an owner id — more so when the response echoes it back.	API3:2023
Rate limiting	A busy endpoint, or a login, token or reset endpoint, whose responses never carry a RateLimit header or a 429. A passive signal: the server may limit without advertising it.	API4:2023
Verbose errors	An error response that leaked a stack trace, a database error or a debug page (Python tracebacks, Java and .NET stack traces, SQL errors, PHP and Rails errors, Flask and Whoops debug pages).	API8:2023
Sensitive data	An API key, token, private key or card number returned in a response. (Secrets your client sends stay in the Secrets tab.)	API3:2023
Headers & cookies / CORS	Missing security headers, weak cookie flags and risky CORS — the same checks as the Security tab, shown here per finding so the whole scan is in one place.	API8:2023
JWT	A token in use with alg: none, no expiry, or a very long lifetime. For every token and sign-in flow in detail, use Tokens and sign-in; this raises only what’s obvious from the token.	API2:2023
GraphQL	A GraphQL endpoint that answered an introspection query with its full schema in production, or accepted a large batch of operations (10 or more in one request) or a deeply nested query (8 levels or more) — ways to multiply what one request costs and get around rate limits.	API9:2023, API4:2023
Desync risk	HTTP request-smuggling signals: a message with both Content-Length and Transfer-Encoding, conflicting length headers, an odd Transfer-Encoding, or a front end whose Via header shows it forwards over HTTP/1.1 (an HTTP/2-to-HTTP/1.1 downgrade).	API8:2023

Each finding carries a severity, the evidence that triggered it (masked ids, a one-line snippet, the offending headers), a plain-language fix, and the request ids behind it.

Desync risk (request smuggling)

Front ends that downgrade HTTP/2 to HTTP/1.1 are a common source of parser-discrepancy bugs, and conflicting length headers are the classic setup for request smuggling. The Desync risk category flags those signals in the headers Cloak Proxy captured:

• Both length headers on one message (Content-Length and Transfer-Encoding) — high. Two servers in the chain can disagree about where the body ends.
• Conflicting or duplicate Content-Length headers.
• An unusual Transfer-Encoding, such as chunked, chunked or xchunked — a common obfuscation.
• A front end that forwards over HTTP/1.1 — low. A CDN or load balancer whose Via header shows an HTTP/1.x hop (for example Via: 1.1 varnish) downgrades requests if it accepts HTTP/2 from clients. This is an architecture signal, not a vulnerability on its own.

It does no active probing; it points at a message worth a closer look. The background is PortSwigger’s HTTP/1.1 must die.

Why the HTTP version alone isn't used

Cloak Proxy answers each client in the client’s own protocol, so it records a response under the client’s HTTP version, not the server’s. A downgrade can’t be read from the recorded version, so the scan relies on the server’s own Via header instead.

Add a finding to a report

Expand a finding and click Add to Findings to send it to an engagement report, with its severity, evidence, the OWASP and CWE references, the affected endpoint and the backing requests filled in. See Findings and reports.

From the MCP server

The same scan is available to AI assistants as the read-only api_scan tool: it returns the findings with their category, severity, evidence, fix, OWASP id and request ids, and takes a category, min_severity, format (summary or markdown) and in_scope (only requests in the active target scope). It sends nothing. See the MCP tools reference.

On Linux

Since 0.5.1 The Linux app’s Insights window has no API Scan tab yet. Use the api_scan MCP tool.

Related

Authorization MatrixConfirm an IDOR candidate by replaying the endpoint as another identity.

SecurityPer-host A–F grades for headers, cookies and CORS.

SecretsKeys, tokens and card numbers in captured traffic.

Findings and reportsCollect findings into an engagement report.