Apigee as a API security scanner

Apigee is an API management platform that includes monitoring, analytics, and developer portal features. As a scanner, it can surface configuration issues and traffic patterns, but it is not a dedicated API security scanner that replaces purpose-built tools. middleBrick is a self-service scanner focused on detection and risk scoring rather than management operations.

middleBrick performs black-box scanning with no agents, no SDKs, and no code access. It requires only a reachable URL and supports any language, framework, or cloud. Scan time is under a minute using read-only methods plus text-only POST for LLM probes. This approach avoids intrusive payloads and keeps the production environment untouched, contrasting with solutions that require instrumentation or deployment artifacts.

The scanner covers 12 categories aligned to OWASP API Top 10 (2023). It maps findings to PCI-DSS 4.0 and SOC 2 Type II for compliance evidence, and supports audit preparation for these frameworks. Detection includes authentication bypasses, JWT misconfigurations, BOLA and BFLA, input validation issues, rate limiting, data exposure, encryption gaps, SSRF indicators, inventory problems, unsafe consumption patterns, and LLM/AI security probes across multiple tiers.

middleBrick parses OpenAPI 3.0, 3.1, and Swagger 2.0 with recursive $ref resolution, cross-referencing spec definitions against runtime behavior. Authenticated scanning supports Bearer, API key, Basic auth, and cookies, gated by domain verification so only domain owners can scan with credentials. Header forwarding is limited to allowlisted headers to reduce noise and risk.

The scanner does not fix, patch, block, or remediate findings. It does not perform active SQL injection or command injection, which fall outside its read-only design. Business logic vulnerabilities require human expertise, and blind SSRF is out of scope due to the lack of out-of-band infrastructure. It does not replace a human pentester for high-stakes audits and is not positioned as a full audit replacement.

Products include a Web Dashboard for scanning and score tracking, a CLI for on-demand scans, a GitHub Action for CI/CD gating, an MCP server for AI coding assistants, and a programmatic API. Continuous monitoring is available on Pro tiers with scheduled rescans, diff detection, email alerts, HMAC-SHA256 signed webhooks, and compliance report downloads. Pricing ranges from free for basic scans to enterprise tiers with unlimited APIs, custom rules, SSO, and dedicated support.