API BOM
Last updated
Last updated
Copyright ©2024 OX Security. All rights reserved.
At a glance: Review a detailed list of all API endpoints exposed by your applications. Map specific detected issues to the APIs that expose them (for APIs written in supported languages).
See the list of currently supported for:
• API detection • API/issue correlation
API BOM provides you with a detailed inventory of the API endpoints (both internal and external) defined in your application code. It identifies APIs:
Why does it matter?
API BOM gives you the ability to better understand your app exposure, making it easier to:
Ensure that all your APIs have undergone appropriate security review procedures. This is especially helpful in managing the review of newly added APIs.
Manage particularly risky elements of your APIs even when they are legitimately and intentionally included in code.
API BOM allows you to prioritize issues exposed by APIs (which makes it more likely that there is a path for an attacker to exploit them).
API BOM maps specific Code security and Open source security issues to the APIs that expose them when both of the following conditions are met:
An issue is considered to be exposed by an API when there is a function call path between the API handler function and the function containing the issue.
The API BOM summary table provides detailed information about each API discovered. A specific API (Title) is listed once for each endpoint/method combination it references.
In the summary table:
Click on the title of any column to sort the table by that column. (By default, the table is sorted by First seen.)
Use the filters on the left side of the page to view specific information in the table according to your preferences.
Select a row in the summary table to open detailed API information at the bottom of the page.
Directly referenced by your code.
Defined by OpenAPI specification files in your repositories.
Consider, for example, an API containing a method that could potentially alter your application or user data. At the very least, it's important to be aware that this method exists in your code so that you can manage potential risks.
The API is discovered in code.
The API is written in a for which this feature is supported.
Click the button to export the full or filtered table as a CSV file.
Title: The name of the API
|
Highest severity exposed issues: The number of issues exposed by the API in each of the 3 highest severity levels. |
Endpoint: The URL of the endpoint referenced by the code or OpenAPI file. |
Method: The HTTP method for the endpoint. |
Functions: The functions called by the API.
|
First seen: The date the API was first detected by OX.
|
Source:
|
App name: The app (repository) in which the API is referenced. |
Tabs: Switch among tabs to navigate the types of detailed information available:
|
For APIs discovered in code, the Title is the word API appended to the end of the application name (repository) in which the API is referenced.
For APIs discovered in OpenAPI specification files, the Title matches the title defined in the file.
This column contains data only when the conditions for are met.
Click a circled number in the column to view the page pre-filtered by these issues.
This column contains data only when the API was discovered in code .
= API discovered in code.
= API discovered in OpenAPI specification file.
Click the link to view the app on the page.
Click the button to view the page pre-filtered by the issues exposed by the API.
This button is displayed when the conditions for are met.
The Exposed issue statistics tab is displayed when the conditions for are met.
