Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1aad035493b3b7350fa2d6a4f2ca8dd4b71af973b576df8c8
Public Swagger UI/API detected at path: /swagger/index.html - sample paths: GET / GET /api/License/machine GET /api/License/timestamp POST /api/License/self POST /api/License/updateclaims POST /connect/token
Severity: info
Fingerprint: 5733ddf49ff49cd1aad035497e6e9f16a8e66ef6f2f8008ebc7de1b8613003c7
Public Swagger UI/API detected at path: /swagger/index.html - sample paths: GET /api/License/machine GET /api/License/timestamp POST /api/License/self POST /api/License/updateclaims POST /connect/token
Severity: info
Fingerprint: 5733ddf49ff49cd1aad035493b3b7350fa2d6a4f2ca8dd4b1169d68f2e1c0ac2
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /
GET /api/License/machine
GET /api/License/timestamp
GET /license-ui/{licenseId}
GET /license-ui/{licenseId}/file
GET /license-uis
POST /api/License/self
POST /api/License/updateclaims
POST /connect/token
POST /license-ui
POST /license-ui/{licenseId}/activate
PUT /license-ui/{licenseId}/merge-duplicate
Severity: info
Fingerprint: 5733ddf49ff49cd1aad0354917b922a095cb8b0ab98ad98e08a01ec792aab9f5
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
DELETE /api/Configuration/state
GET /api/Configuration/all
GET /api/Configuration/applied
GET /api/Configuration/byid
GET /api/Configuration/changes
GET /api/Configuration/clone
GET /api/Device
GET /api/Device/{id}
GET /api/Iot
GET /api/License
GET /api/License/machine
GET /api/License/self/approved
GET /api/License/timestamp
GET /api/License/wavex/create/download
GET /api/License/wavex/create/file
GET /api/Organization
GET /api/Organization/{id}
GET /api/Parameter
GET /api/Parameter/group
GET /api/Parameter/group/{id}
GET /api/Parameter/{id}
GET /api/Ping
GET /api/Settings/frontend
GET /api/Site
GET /api/Site/{id}
GET /api/Sync/configuration/metadata/ids
GET /api/Sync/configuration/metadata/missing
GET /api/Sync/configuration/missing
GET /api/Sync/configuration/timestamps
GET /api/Tenant
GET /api/User
GET /api/User/claims
GET /api/User/organization/{organizationId}
GET /authenticationapi/check
GET /authenticationapi/external/login
GET /authenticationapi/how
GET /authenticationapi/logout
POST /api/Configuration/tag
POST /api/License/self
POST /api/License/updateclaims
POST /api/Sync/configuration
POST /api/Sync/configuration/metadata
POST /authenticationapi/login
PUT /api/Configuration
PUT /api/User/permission/site/allowed
PUT /api/User/permission/site/owner
Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1aad0354917b922a095cb8b0ab98ad98e08a01ec792aab9f5
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
DELETE /api/Configuration/state
GET /api/Configuration/all
GET /api/Configuration/applied
GET /api/Configuration/byid
GET /api/Configuration/changes
GET /api/Configuration/clone
GET /api/Device
GET /api/Device/{id}
GET /api/Iot
GET /api/License
GET /api/License/machine
GET /api/License/self/approved
GET /api/License/timestamp
GET /api/License/wavex/create/download
GET /api/License/wavex/create/file
GET /api/Organization
GET /api/Organization/{id}
GET /api/Parameter
GET /api/Parameter/group
GET /api/Parameter/group/{id}
GET /api/Parameter/{id}
GET /api/Ping
GET /api/Settings/frontend
GET /api/Site
GET /api/Site/{id}
GET /api/Sync/configuration/metadata/ids
GET /api/Sync/configuration/metadata/missing
GET /api/Sync/configuration/missing
GET /api/Sync/configuration/timestamps
GET /api/Tenant
GET /api/User
GET /api/User/claims
GET /api/User/organization/{organizationId}
GET /authenticationapi/check
GET /authenticationapi/external/login
GET /authenticationapi/how
GET /authenticationapi/logout
POST /api/Configuration/tag
POST /api/License/self
POST /api/License/updateclaims
POST /api/Sync/configuration
POST /api/Sync/configuration/metadata
POST /authenticationapi/login
PUT /api/Configuration
PUT /api/User/permission/site/allowed
PUT /api/User/permission/site/owner
Open service 13.107.246.44:443 · admin.test.miros.app
2026-01-23 16:00
HTTP/1.1 200 OK Date: Fri, 23 Jan 2026 16:00:34 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close x-azure-ref: 20260123T160034Z-r17955489d5ks8hshC1FRA4k6g0000000qk000000000n0kq X-Cache: CONFIG_NOCACHE "alive"
Open service 20.50.64.2:80 · admin.test.miros.app
2026-01-22 20:59
HTTP/1.1 404 Site Not Found
Content-Length: 2667
Connection: close
Content-Type: text/html
Date: Thu, 22 Jan 2026 20:59:37 GMT
Page title: Microsoft Azure Web App - Error 404
<!DOCTYPE html>
<html>
<head>
<title>Microsoft Azure Web App - Error 404</title>
<style type="text/css">
html {
height: 100%;
width: 100%;
}
#feature {
width: 960px;
margin: 75px auto 0 auto;
overflow: auto;
}
#content {
font-family: "Segoe UI";
font-weight: normal;
font-size: 22px;
color: #ffffff;
float: left;
margin-top: 68px;
margin-left: 0px;
vertical-align: middle;
}
#content h1 {
font-family: "Segoe UI Light";
color: #ffffff;
font-weight: normal;
font-size: 60px;
line-height: 48pt;
width: 800px;
}
a, a:visited, a:active, a:hover {
color: #ffffff;
}
#content a.button {
background: #0DBCF2;
border: 1px solid #FFFFFF;
color: #FFFFFF;
display: inline-block;
font-family: Segoe UI;
font-size: 24px;
line-height: 46px;
margin-top: 10px;
padding: 0 15px 3px;
text-decoration: none;
}
#content a.button img {
float: right;
padding: 10px 0 0 15px;
}
#content a.button:hover {
background: #1C75BC;
}
</style>
<script type="text/javascript">
function toggle_visibility(id) {
var e = document.getElementById(id);
if (e.style.display == 'block')
e.style.display = 'none';
else
e.style.display = 'block';
}
</script>
</head>
<body bgcolor="#00abec">
<div id="feature">
<div id="content">
<h1>404 Web Site not found.</h1>
<p>You may be seeing this error due to one of the reasons listed below :</p>
<ul>
<li>Custom domain has not been configured inside Azure. See <a href="https://go.microsoft.com/fwlink/?linkid=2194614">how to map an existing domain</a> to resolve this.</li>
<li>Client cache is still pointing the domain to old IP address. Clear the cache by running the command <i>ipconfig/flushdns.</i></li>
</ul>
<p>Checkout <a href="https://go.microsoft.com/fwlink/?linkid=2194451">App Service Domain FAQ</a> for more questions.</p>
</div>
</div>
</body>
</html>
Open service 13.107.246.44:443 · admin.test.miros.app
2026-01-09 01:51
HTTP/1.1 200 OK Date: Fri, 09 Jan 2026 01:51:41 GMT Transfer-Encoding: chunked Connection: close cache-control: public, max-age=300, s-maxage=300 expires: Fri, 09 Jan 2026 01:52:41 GMT x-azure-ref: 20260109T015140Z-r17955489d56v56rhC1FRA8dq400000007eg000000006km2 X-Cache: CONFIG_NOCACHE healthy
Open service 20.50.64.2:80 · admin.test.miros.app
2026-01-08 23:17
HTTP/1.1 404 Site Not Found
Content-Length: 2667
Connection: close
Content-Type: text/html
Date: Thu, 08 Jan 2026 23:18:39 GMT
Page title: Microsoft Azure Web App - Error 404
<!DOCTYPE html>
<html>
<head>
<title>Microsoft Azure Web App - Error 404</title>
<style type="text/css">
html {
height: 100%;
width: 100%;
}
#feature {
width: 960px;
margin: 75px auto 0 auto;
overflow: auto;
}
#content {
font-family: "Segoe UI";
font-weight: normal;
font-size: 22px;
color: #ffffff;
float: left;
margin-top: 68px;
margin-left: 0px;
vertical-align: middle;
}
#content h1 {
font-family: "Segoe UI Light";
color: #ffffff;
font-weight: normal;
font-size: 60px;
line-height: 48pt;
width: 800px;
}
a, a:visited, a:active, a:hover {
color: #ffffff;
}
#content a.button {
background: #0DBCF2;
border: 1px solid #FFFFFF;
color: #FFFFFF;
display: inline-block;
font-family: Segoe UI;
font-size: 24px;
line-height: 46px;
margin-top: 10px;
padding: 0 15px 3px;
text-decoration: none;
}
#content a.button img {
float: right;
padding: 10px 0 0 15px;
}
#content a.button:hover {
background: #1C75BC;
}
</style>
<script type="text/javascript">
function toggle_visibility(id) {
var e = document.getElementById(id);
if (e.style.display == 'block')
e.style.display = 'none';
else
e.style.display = 'block';
}
</script>
</head>
<body bgcolor="#00abec">
<div id="feature">
<div id="content">
<h1>404 Web Site not found.</h1>
<p>You may be seeing this error due to one of the reasons listed below :</p>
<ul>
<li>Custom domain has not been configured inside Azure. See <a href="https://go.microsoft.com/fwlink/?linkid=2194614">how to map an existing domain</a> to resolve this.</li>
<li>Client cache is still pointing the domain to old IP address. Clear the cache by running the command <i>ipconfig/flushdns.</i></li>
</ul>
<p>Checkout <a href="https://go.microsoft.com/fwlink/?linkid=2194451">App Service Domain FAQ</a> for more questions.</p>
</div>
</div>
</body>
</html>
Open service 20.50.64.2:80 · admin.test.miros.app
2026-01-01 23:18
HTTP/1.1 404 Site Not Found
Content-Length: 2667
Connection: close
Content-Type: text/html
Date: Thu, 01 Jan 2026 23:18:52 GMT
Page title: Microsoft Azure Web App - Error 404
<!DOCTYPE html>
<html>
<head>
<title>Microsoft Azure Web App - Error 404</title>
<style type="text/css">
html {
height: 100%;
width: 100%;
}
#feature {
width: 960px;
margin: 75px auto 0 auto;
overflow: auto;
}
#content {
font-family: "Segoe UI";
font-weight: normal;
font-size: 22px;
color: #ffffff;
float: left;
margin-top: 68px;
margin-left: 0px;
vertical-align: middle;
}
#content h1 {
font-family: "Segoe UI Light";
color: #ffffff;
font-weight: normal;
font-size: 60px;
line-height: 48pt;
width: 800px;
}
a, a:visited, a:active, a:hover {
color: #ffffff;
}
#content a.button {
background: #0DBCF2;
border: 1px solid #FFFFFF;
color: #FFFFFF;
display: inline-block;
font-family: Segoe UI;
font-size: 24px;
line-height: 46px;
margin-top: 10px;
padding: 0 15px 3px;
text-decoration: none;
}
#content a.button img {
float: right;
padding: 10px 0 0 15px;
}
#content a.button:hover {
background: #1C75BC;
}
</style>
<script type="text/javascript">
function toggle_visibility(id) {
var e = document.getElementById(id);
if (e.style.display == 'block')
e.style.display = 'none';
else
e.style.display = 'block';
}
</script>
</head>
<body bgcolor="#00abec">
<div id="feature">
<div id="content">
<h1>404 Web Site not found.</h1>
<p>You may be seeing this error due to one of the reasons listed below :</p>
<ul>
<li>Custom domain has not been configured inside Azure. See <a href="https://go.microsoft.com/fwlink/?linkid=2194614">how to map an existing domain</a> to resolve this.</li>
<li>Client cache is still pointing the domain to old IP address. Clear the cache by running the command <i>ipconfig/flushdns.</i></li>
</ul>
<p>Checkout <a href="https://go.microsoft.com/fwlink/?linkid=2194451">App Service Domain FAQ</a> for more questions.</p>
</div>
</div>
</body>
</html>
Open service 13.107.246.44:443 · admin.test.miros.app
2026-01-01 19:46
HTTP/1.1 200 OK Date: Thu, 01 Jan 2026 19:46:39 GMT Transfer-Encoding: chunked Connection: close cache-control: public, max-age=300, s-maxage=300 expires: Thu, 01 Jan 2026 19:47:39 GMT x-azure-ref: 20260101T194639Z-159b47b56b6h84zphC1SG1abec0000001s8g000000002gha X-Cache: CONFIG_NOCACHE healthy
Open service 13.107.246.44:443 · admin.test.miros.app
2025-12-22 20:14
HTTP/1.1 200 OK Date: Mon, 22 Dec 2025 20:14:48 GMT Transfer-Encoding: chunked Connection: close cache-control: public, max-age=300, s-maxage=300 expires: Mon, 22 Dec 2025 20:15:48 GMT x-azure-ref: 20251222T201448Z-185d974d666cgfflhC1FRAh0vc0000001d7g00000000bbg3 X-Cache: CONFIG_NOCACHE healthy
Open service 20.50.64.2:80 · admin.test.miros.app
2025-12-22 11:19
HTTP/1.1 404 Site Not Found
Content-Length: 2667
Connection: close
Content-Type: text/html
Date: Mon, 22 Dec 2025 11:19:08 GMT
Page title: Microsoft Azure Web App - Error 404
<!DOCTYPE html>
<html>
<head>
<title>Microsoft Azure Web App - Error 404</title>
<style type="text/css">
html {
height: 100%;
width: 100%;
}
#feature {
width: 960px;
margin: 75px auto 0 auto;
overflow: auto;
}
#content {
font-family: "Segoe UI";
font-weight: normal;
font-size: 22px;
color: #ffffff;
float: left;
margin-top: 68px;
margin-left: 0px;
vertical-align: middle;
}
#content h1 {
font-family: "Segoe UI Light";
color: #ffffff;
font-weight: normal;
font-size: 60px;
line-height: 48pt;
width: 800px;
}
a, a:visited, a:active, a:hover {
color: #ffffff;
}
#content a.button {
background: #0DBCF2;
border: 1px solid #FFFFFF;
color: #FFFFFF;
display: inline-block;
font-family: Segoe UI;
font-size: 24px;
line-height: 46px;
margin-top: 10px;
padding: 0 15px 3px;
text-decoration: none;
}
#content a.button img {
float: right;
padding: 10px 0 0 15px;
}
#content a.button:hover {
background: #1C75BC;
}
</style>
<script type="text/javascript">
function toggle_visibility(id) {
var e = document.getElementById(id);
if (e.style.display == 'block')
e.style.display = 'none';
else
e.style.display = 'block';
}
</script>
</head>
<body bgcolor="#00abec">
<div id="feature">
<div id="content">
<h1>404 Web Site not found.</h1>
<p>You may be seeing this error due to one of the reasons listed below :</p>
<ul>
<li>Custom domain has not been configured inside Azure. See <a href="https://go.microsoft.com/fwlink/?linkid=2194614">how to map an existing domain</a> to resolve this.</li>
<li>Client cache is still pointing the domain to old IP address. Clear the cache by running the command <i>ipconfig/flushdns.</i></li>
</ul>
<p>Checkout <a href="https://go.microsoft.com/fwlink/?linkid=2194451">App Service Domain FAQ</a> for more questions.</p>
</div>
</div>
</body>
</html>