For websites with links and forms, crawling usually finds the pages. For APIs, importing an OpenAPI description gives the scanner a complete list of endpoints that a crawler would never see. The strongest setup uses both and compares what each found.
What each approach does
Crawling follows links and submits forms, like a visitor. It discovers what the front end exposes.
Spec import reads an API description. The OpenAPI Specification defines a language agnostic interface to HTTP APIs, so people and tools can understand a service without reading source code or watching traffic. A scanner given that file knows each path, method and parameter.
Where each one fails
| Crawl | Spec import | |
|---|---|---|
| Single page apps with heavy scripts | May miss routes | Not relevant |
| REST endpoints not linked from any page | Missed | Found |
| Undocumented or forgotten endpoints | Found only if linked | Missed |
| Needs a maintained document | No | Yes |
| Parameter types and required fields | Guessed | Known |
The spec only lists what the team documented. Old endpoints that nobody wrote down are exactly the ones that tend to be unprotected, and only observed traffic or a crawl may reveal them.
A practical plan
- Export the current API description from your build, not an old copy.
- Import it into the scanner and run a scan with a test account.
- Run a crawl or a proxy recorded session of the front end against the same target.
- Compare the endpoint lists. Anything seen in traffic but absent from the spec is a documentation gap and a risk to review.
- Repeat when the API changes.
Keep the OWASP lists in mind
The OWASP API Security Top 10 2023 is the second edition of a list first published in 2019. Its introduction advises teams with an app backed by an API to review both the relevant app focused list and the API list.
Common mistakes
Teams often import a spec and assume coverage is complete. Check the scan report for the number of endpoints tested against the number in the file, and look at which ones returned errors, since an endpoint that always fails to authenticate has not really been tested. Also confirm that the scanner uses realistic values for required parameters. Sending empty strings to every field usually produces shallow results, so supply sample data where the tool allows it.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how endpoints are listed and which ones raise findings.
Where Safeguard fits
Safeguard provides SBOM and dependency scanning, reachability analysis and policy gates. Try the free scan for the dependency side.
Quick check
Does a spec import replace authentication setup?
No. The scanner still needs valid credentials to reach protected endpoints.
What if my spec is out of date?
Regenerate it from code in the build. A stale file silently shrinks your coverage.
Sources
Last reviewed: 19 October 2026.
