At a glance: Review a detailed list of all API endpoints exposed by your applications. Map specific detected issues to the APIs that expose them (for APIs written in supported languages).

See the list of languages and web frameworks currently supported for:

• API detection • API/issue correlation


API BOM provides you with a detailed inventory of the API endpoints (both internal and external) defined in your application code. It identifies APIs:

Why does it matter?

#2 – API BOM allows you to prioritize issues exposed by APIs (making it more likely that there is a path for an attacker to exploit them).

API/issue correlation

API BOM maps specific Code security and Open source security issues to the APIs that expose them when both of the following conditions are met:

An issue is considered to be exposed by an API when there is a function call path between the API handler function and the function containing the issue.

Summary table

The API BOM summary table provides detailed information about each API discovered. A specific API (Title) is listed once for each endpoint/method combination it references.

In the summary table:

  • Click on the title of any column to sort the table by that column. (By default, the table is sorted by First seen.)

  • Use the filters on the left side of the page to view specific information in the table according to your preferences.

Summary table data

Title: The name of the API

    • For example, the Title of an API discovered in the millennium-falcon repository is millennium-falcon API.

Highest severity exposed issues: The number of issues exposed by the API in each of the 3 highest severity levels.

Endpoint: The URL of the endpoint referenced by the code or OpenAPI file.

Method: The HTTP method for the endpoint.

Functions: The functions called by the API.

  • Click on a function link to view the function at its precise location in your code repository (in a new browser tab).

First seen: The date the API was first detected by OX.

  • This is the date of first detection, not the date on which the API was added to the code.


    • Click the icon to view the API reference at its precise location in your code repository (in a new browser tab).

    • Click the icon to view the OpenAPI file in your code repository (in a new browser tab). Note that this link takes you to the OpenAPI file, not to the specific line within the file that references the API.

App name: The app (repository) in which the API is referenced.

API details

Select a row in the summary table to open detailed API information at the bottom of the page.

Tabs: Switch among tabs to navigate the types of detailed information available:

  • The Exposed issue statistics tab is displayed when the conditions for API/issue correlation are met.

  • The Parameters and Responses tabs are displayed when OX is able to detect this information for the API.

Last updated

Copyright ©2024 OX Security. All rights reserved.