Skip to content
Hardn

Help centre · Walkthrough

Scan an API you own

Here's how to scan an API you own, and how to give Hardn your OpenAPI spec. (1:06)

All help topics

Step by step

The same steps as the video.

  1. 1

    Add your API

    Open Sites and choose Add site. Enter your API's base address, choose REST API, confirm you're allowed to test it, and continue.

    Enter the base address your clients call, for example https://api.example.com/v1, and choose REST API.

  2. 2

    Prove you own it

    Prove you own the domain the same way as a website, with a DNS record or a file. Then choose Check now.

    The same proof as a website: a TXT record on _hardn-challenge.api.example.com, or the verification file on the API's host.

  3. 3

    Attach your OpenAPI spec

    In the API's settings, paste your OpenAPI document and attach it. Hardn uses its paths to guide deeper checks, and never runs it.

    Open the API, choose Settings, and paste the OpenAPI or Swagger document as JSON under API spec. Hardn reads its GET paths; it never calls anything that changes data.

  4. 4

    Scan the API

    Choose Scan now and start a public scan. Hardn checks TLS, headers, CORS and what the API gives away, without changing any data.

  5. 5

    Read the report, go deeper

    Your report grades the API and explains each issue. For a deep scan, add two test accounts, so Hardn can check one user can't read another's data.

    For a deep scan, add two test accounts under Settings → Test accounts (deep scan). Hardn signs in as each and checks one can't read the other's data.

If something goes wrong

The spec isn't accepted.
Paste JSON. If your spec is YAML, export or convert it to JSON first.
Everything answers 401.
That's expected for a private API: the public scan still checks TLS, headers, CORS and what's exposed without signing in. Add test accounts for the signed-in checks.
Deep scan isn't available.
A deep scan needs at least one test account. It's included on Pro and Agency, and costs 3 credits on other plans.

More walkthroughs

Still stuck? Email support@hardn.si and a person will reply.