Alternatives to Apigee at Enterprise organizations

An API security scanner is a black-box tool that submits requests to an endpoint and interprets responses. It does not require access to source code, agents, or SDKs and supports any language or framework. The scanner completes a run in under a minute using read-only methods such as GET and HEAD, and text-only POST for LLM probes.

The scanner evaluates 12 categories aligned to the OWASP API Top 10 (2023) and maps findings to PCI-DSS 4.0 and SOC 2 Type II. It covers authentication bypasses, JWT misconfigurations such as alg=none and expired tokens, BOLA and IDOR via sequential ID probing, BFLA and privilege escalation attempts, property over-exposure, input validation issues like CORS wildcard usage and dangerous HTTP methods, rate-limiting behavior, data exposure including PII and API key formats, encryption misconfigurations, SSRF indicators, and inventory management weaknesses.

For AI-facing APIs, the scanner runs 18 adversarial probes across Quick, Standard, and Deep tiers, testing for system prompt extraction, instruction override, DAN and roleplay jailbreaks, data exfiltration, cost exploitation, encoding bypass, translation-embedded injection, few-shot poisoning, markdown injection, multi-turn manipulation, indirect prompt injection, token smuggling, tool-abuse, nested instruction injection, and PII extraction.

OpenAPI specifications in versions 3.0, 3.1, and Swagger 2.0 are parsed with recursive $ref resolution, and findings are cross-referenced against the spec to identify undefined security schemes or deprecated operations.

Authenticated scanning is available starting at the Starter tier and supports Bearer tokens, API keys, Basic auth, and cookies. Domain verification requires a DNS TXT record or an HTTP well-known file to ensure only the domain owner can scan with credentials. The scanner forwards a restricted allowlist of headers including Authorization, X-API-Key, Cookie, and X-Custom-*.

The scanner maintains a strict read-only posture and never sends destructive payloads. Private IPs, localhost, and cloud metadata endpoints are blocked at multiple layers. Customer scan data can be deleted on demand and is purged within 30 days of cancellation. It is not used for model training.

Results are accessed through a Web Dashboard that provides scan history, risk scores, and downloadable compliance PDFs. The CLI supports commands such as middlebrick scan <url> with JSON or text output. A GitHub Action can integrate scanning into CI/CD pipelines and fail the build when the score drops below a set threshold. The MCP Server allows scanning from AI coding assistants such as Claude and Cursor.

Pro tier enables scheduled rescans every 6 hours, daily, weekly, or monthly. It provides diff detection across scans to highlight new findings, resolved findings, and score drift. Email alerts are rate-limited to one per hour per API, and webhooks are HMAC-SHA256 signed and auto-disabled after 5 consecutive failures.

The Free tier allows 3 scans per month with CLI access. The Starter tier at 99 dollars per month supports 15 APIs, monthly scans, dashboard access, email alerts, and the MCP Server. The Pro tier at 499 dollars per month covers 100 APIs, with additional APIs at 7 dollars each, and adds continuous monitoring, GitHub Action gates, CI/CD integration, Slack and Teams alerts, compliance reports, and signed webhooks. Enterprise at 2000 dollars per month provides unlimited APIs, custom rules, SSO, audit logs, an SLA, and dedicated support.

Because the scanner is a detection tool, it does not fix, patch, block, or remediate issues. It provides findings with remediation guidance. It does not perform active SQL injection or command injection testing, which requires intrusive payloads outside its scope. It does not detect business logic vulnerabilities, blind SSRF relying on out-of-band infrastructure, or replace a human pentester for high-stakes audits.