Uploading Your API Specifications ¶
In the API Specifications section of the Wallarm Console UI, you can keep your API specifications which Wallarm uses to uncover shadow APIs. This article gives an information on how to use this section.
Administrators and Global administrators can add, remove and download specifications and change settings of shadow API detection. Users of other roles can only view the list of uploaded specifications.
Revealing shadow API¶
With API Discovery in use, your API specifications uploaded at the API Specifications section may be compared with what was automatically detected by API Discovery. As the result of this comparison, Wallarm finds and shows shadow APIs - endpoints discovered by Wallarm, but absent in your specification (missing endpoints).
To perform comparison:
Navigate to the API Specifications section and click Upload specification.
Select a specification to upload. It must be in the OpenAPI 3.0 JSON or YAML format.
Set comparison parameters:
Application(s) and host(s) - only endpoints related to the selected applications/hosts will be compared. If you select Compare with all current and future discovered applications hosts, all hosts (of the selected applications) known now and all hosts that will be discovered in future will be included into comparison.
You can change comparison settings at any moment later - after this the comparison will be re-done providing new results.
From where to upload: your local machine or URL. For URLs, via the header fields you can specify a token for authentication.
- Whether the comparison should be performed once after specification upload or every hour (the Perform regular comparison option is selected by default). Hourly comparison allows finding additional shadow APIs as API Discovery discovers more endpoints. Specification uploaded from URL is updated before each comparison.
Note that you can re-start comparison at any moment manually via specification menu → Restart comparison.
As uploading is finished, the number of shadow APIs will be displayed for each specification in the list of API Specifications as well as the overall number of found unique shadow APIs. Also shadow APIs will be displayed in the API Discovery section.
Download previously uploaded specifications¶
You can download the previously uploaded specification via API Specifications → specification details window → Download specification.