42Crunch API Scan

42Crunch API Scan is a dynamic API security testing tool that validates API implementations against their OpenAPI/Swagger definitions at both testing time and runtime. The tool simulates real API traffic to test API behavior under load and validates whether APIs can properly handle or reject requests according to their OpenAPI specifications.

The tool detects OWASP API Security Top 10 vulnerabilities early in the API lifecycle, including issues such as data leakage, overflows, mass assignment, broken authentication, and security misconfigurations. It identifies vulnerabilities triggered by wrong verbs, paths, content-types, data formats, constraint violations, and data injection attempts.

API Scan flags responses that are unknown (such as HTTP 500 errors), of incorrect types (HTML instead of JSON), or that do not match the JSON schemas described in the OpenAPI Specification. The tool generates immediate reports with actionable information on API conformance, summarizing key issues and providing detailed analysis including cURL requests used to detect each issue.

The tool is part of the 42Crunch API Security Platform and supports shift-left security practices by enabling continuous runtime behavior scanning throughout the API lifecycle. It integrates into development workflows through IDE extensions, CI/CD pipelines, and supports automated security testing in environments like GitHub Actions.