Cortex Cloud offers the option to import API specifications that comply with the OpenAPI format, including format, file structure, and data types.
In addition to observing API traffic, Cortex Cloud scans AWS and Azure API gateways, and extracts the API specification files. Once the specification files are in the inventory, Cortex Cloud scans them for misconfigurations and vulnerabilities, providing insights into your API landscape.
Use Cortex Cloud to validate live traffic against specifications and alert on surface deviations, undocumented endpoints, or security gaps.
The following table describes the fields that are available for each API specification.
Field | Description |
|---|---|
Sources | Source of the API specification:
|
Asset Name | Asset name is obtained from the |
Servers List | This field is automatically filled if the specification contains the server URL or host. You must manually add the URL or host address if there is no URL or host in the specification. NoteEven if you have already imported the specification, you can edit the API specification in Cortex Cloud and add or update the server list. |
API Versions | API version obtained from the API specification. |
Associated Endpoints | Shows the number of endpoints that match the specification. You can right-click and select View Associated Endpoints to see the matched paths in the API Endpoints table. |
Format & Version | OpenAPI or Swagger and the relative version. |
Spec File Name | Specification file name that was imported to Cortex Cloud. |
Findings | The total number of findings is broken down by severity, and findings with a severity of high trigger an issue. |
Status | Indicates if the specification is:
|
Click the API asset to open the side card. Each tab includes detailed information from the parsed data of the API.
You can add Comments (
) to the specification, providing additional context about the API endpoints or other relevant information.