The five suites

API catalog

API catalog records every XHR and fetch the interface sends: method, query, request body, status, and response.

1. 01

   Run a scan so the browser opens the app

   The worker keeps calls that stay on the target host. Static assets are dropped. Two GraphQL operations on the same path stay separate when their operation names differ.

2. 02

   Open the APIs tab

   Each row is one captured call: method, path, status, query keys, a redacted request body, a redacted response, and which identity was in the browser.

3. 03

   Treat this list as the input

   Unguarded access, cross-user replay, and secret classification run against these calls. If a screen never called an endpoint, it is not in the catalog unless the sensitive-path list requests it.

POST /api/search
Identity   Crawl
Status     200
Body       { "query": "{ \"email\": \"[REDACTED_EMAIL]\", \"invoiceId\": \"inv-9001\" }" }

See the redacted example