Home·Guides·API security testing without OpenAPI
API security testing without OpenAPI
Routelint·
You can run API security testing without an OpenAPI or Swagger document by treating the running UI as the source of truth for which routes exist.
Many vibe-coded and AI-built apps never produce a complete spec. Postman collections and OpenAPI generators miss routes the page opened that never made it into a file. The browser already knows the surface: every XHR and fetch on the live app.
Routelint records method, URL, query, body shape, and status from that traffic. The suites then replay each observed call with no session and as a peer account. A 200 with account data anonymously is unguarded access. Matching data as a peer is IDOR. Secrets and paths such as /.env are checked in the same run.
You do not upload a Swagger file to start. Replays stay read-only by default. Ownership proof keeps the scan on a host you control. For counts without an account, use the free site scan; for full evidence, create an account and open the API leak scan.
Compared with proxy tools that expect you to drive every request by hand, this workflow is built for teams who shipped the UI first and need a repeatable check on the handlers behind it.