Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1f5e22fb450568cc07178d73e7178d73e7178d73e7178d73e
Public Swagger UI/API detected at path: /api/swagger.json - sample paths: GET /liveness POST /cybersource/responseUrl
Open service 23.50.131.132:443 · api-utils-preprod.prada.com
2026-01-09 15:36
HTTP/1.1 200 OK Content-Type: text/html Request-Context: appId=cid-v1:bb7b9f97-a0e0-4d08-b644-f2cf8886ab8a X-Akamai-Transformed: 0 - 0 - Expires: Fri, 09 Jan 2026 15:36:42 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Fri, 09 Jan 2026 15:36:42 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding x-api-request-correlation-id: fc537eb0-ea61-4adb-952a-2b297e83fdf5 Strict-Transport-Security: max-age=15768000 ; includeSubDomains ; preload Set-Cookie: _abck=C84D19401A63DB9B725BB05FD182A497~-1~YAAQERczF4CQoJCbAQAAxR5now84mFA2sh1xOxIQ0vNnEp0tdqoWvJkNjKTq3NzgpPPKAs4+loo6NMxFzp6YnYQspq+37ReDNwB8Q0JxnWWoD6oWFdqBlPLGAVANeDujte8BZFEHf7aMOuUEcI+PpvizPXNrELEwIHpusVY2rU+FyFjXqdQSIfkmtfm5/Ws05lvUmTOdaxfOVTaFXZ3lmDXM1Mc2KO3rh9kbpo7oI54d0E/3JKBB480oYoVQU6QuhaBWhAb2G6V+w+lD6m9uhqmdRQQmwUfuib0qQSjCzmXTMclfLTJvtGgWaLeY8dgrqPieS7RsV5KYHi8UYybONdtGW6TYJ11VOsizaF3h1gSTgjuHGIPaJ9oQZf2NzBVb4NY5YEYvjdRzSGBqd7OVM0cQuTA4Z9kwVfx7q1Nf+RkMQlwtP90Rhhd96uS5ST0NJ4ykgQ==~-1~-1~-1~-1~-1; Domain=.prada.com; Path=/; Expires=Sat, 09 Jan 2027 15:36:42 GMT; Max-Age=31536000; SameSite=None; Secure Set-Cookie: bm_sz=6A007BDC9C2E722F0633751862BC21F8~YAAQERczF4GQoJCbAQAAxR5nox5ioLwQ8iChnGEgQ9/GRdRQHTUSiWmNmsJdtsOt9kkCrcDb+nWFcOEOKjB+6gNP4XKUUnsayGyuPhlICDzYSEwIkf9q/vFsLnuuNQrWP3LY3BhN0qAVOM14eCyPgZ12ie4EN7MzPywTpMVIQrrGX9mNfnLldqggaDU7AVDWuzLfpk2qSqxje7+zbznymuau5ZCfL/8rHgggLrn1pSQAEhZctlbJI4zZvab9U8lZVyrX5N+UF1s9DGyIWcgTohoxNiv8XqJbTLMJzzY+TBx3EGk34TtICnIiOUJEyiInWM6boLUqr6ToKuaBt41q0CMl7aGAeOTtIZti9fMS~3616834~4404785; Domain=.prada.com; Path=/; Expires=Fri, 09 Jan 2026 19:36:42 GMT; Max-Age=14400; SameSite=None; Secure
Open service 23.50.131.132:443 · api-utils-preprod.prada.com
2026-01-02 10:44
HTTP/1.1 200 OK Content-Type: text/html Request-Context: appId=cid-v1:bb7b9f97-a0e0-4d08-b644-f2cf8886ab8a X-Akamai-Transformed: 0 - 0 - Expires: Fri, 02 Jan 2026 10:44:07 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Fri, 02 Jan 2026 10:44:07 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding x-api-request-correlation-id: 5a086cab-f3a4-4450-9a87-1bd8f7b4ed09 Strict-Transport-Security: max-age=15768000 ; includeSubDomains ; preload Set-Cookie: _abck=7952266CB57312EC373F783727C1B058~-1~YAAQBBczF0CoEy6bAQAAXLpOfg/PutYiVDbnXaSXhe3DQz76YlzfebE+a0hfoEL6Q6HR/vcoNkMrOJNWo7Lhoiyv999wleH+7RUe0MPxQANcwpoAeNssXrH2dJCcFvZ9FUI+VGAFhFYDHU2eH+5STBGcb9ts7EtCMPgqkPjPalMCabcXB8pDfTb8kAyLe3xDytTQdoF3ASdFMA6UnAXTKqLhtzKUUqKzdg4tkEOOWQ7R4azINC9c1cIAWlAGbidOVCQshRI+qVESBow9fqZLxmW2CggYN66HER7hkLLIC/406Z12g4z5IkH60o7JhHMsRlrTUtQ3voQ34MK0ABXqLNXjLTdFxD2ZDKWBFakmbNhoM/FD4U8xn5xVy0lE34KptME6LqZHPhl3IX1isbSOO1QCd1RLUO3vXdU/YOHo8US1dc0BVLvDgT9l4AdCUJs6J+4X0A==~-1~-1~-1~-1~-1; Domain=.prada.com; Path=/; Expires=Sat, 02 Jan 2027 10:44:07 GMT; Max-Age=31536000; SameSite=None; Secure Set-Cookie: bm_sz=B4851FF613F2AEC24812FFA2549F1A05~YAAQBBczF0GoEy6bAQAAXLpOfh5FBKtzmCieKxWdaBv0iNyvHvDaNEL03HNB/nnlQYcgDYNGgoD0BIoGTCxCAy7N4HSeRv//PFIVJ/kJer8vSSERSRyBBv1WiCHKJmCY0cZOHPHavicx//bZQP7x6zoH+qq6DrecHG+OrfG54dsxle5d2SwJx6h7cMc57ccnhO6OfepiUxNqaKP8zUz7oFmqUEvIzlHbmK6tOGv11q7XrpSyA3WeFjA/3WqKA0P0vm04tzWiwvrkDbEpv8gIx2R5ROF7RyEyeTGv5ylDmR9HfNJxTfcg8V0klQEPjztDi0PFyq/V5f+aJTJ6tfMBks3f1PMWDwTeWkiqYzzF~3488055~3158068; Domain=.prada.com; Path=/; Expires=Fri, 02 Jan 2026 14:44:07 GMT; Max-Age=14400; SameSite=None; Secure
Open service 23.50.131.132:443 · api-utils-preprod.prada.com
2025-12-23 03:22
HTTP/1.1 200 OK Content-Type: text/html Request-Context: appId=cid-v1:bb7b9f97-a0e0-4d08-b644-f2cf8886ab8a X-Akamai-Transformed: 0 - 0 - Expires: Tue, 23 Dec 2025 03:22:14 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Tue, 23 Dec 2025 03:22:14 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding x-api-request-correlation-id: 2bc9228f-dfef-4180-8d3b-c2699b483f8f Strict-Transport-Security: max-age=15768000 ; includeSubDomains ; preload Set-Cookie: _abck=2E922FCD44741668FA1211E10842AD82~-1~YAAQBBczFwsjDyubAQAAtJU6SQ9Yor7z+TNlf0Yymm9cigEtcUEVs7NzFW65OEhIdKeNIgp2d62trzJShEtpe0yHXy8+F1omdf3argPq/q2E2+YqGdV7L8Idq6i5RHn1v4ArpPeJflv4a/NKQLPVkJxear3uFNlAsk2vrlTG9DJDAKCDrezOxUplfjKMPjOebqtIHMqpGF8I2PuN1vTyAfaUOVdnkCfyi4Xt1E/9AVGuQOy+CC6Lsh8dmexl0RYAotyMzcBMAmuKv/Rei3nve1oXMxE9wmCEoqQsjnooJILhvckr3zoFyDuuEyoLEbbFFr621a7mNN2WS5kgpbRFQ3FwwNk9r0daT5BkhpIjfmixVHvr70b6+9gGhDWUJOzv5loYpjSvxp3fJ5W/GpEG3aWUvjh1O4dQS1PjY7J1EIv84/4uYlpG8+MK8l4WlmICuHOphg==~-1~-1~-1~-1~-1; Domain=.prada.com; Path=/; Expires=Wed, 23 Dec 2026 03:22:14 GMT; Max-Age=31536000; SameSite=None; Secure Set-Cookie: bm_sz=AB349AA382E7E3E92AD88849B4F9A3FF~YAAQBBczFwwjDyubAQAAtJU6SR41q9V6qvqqZAKNQlxTaIQdQLgRjboLCa92zkJ0e4tVHeHy71NnLTniggIujnKm1F+ddUPKFDblmeveao3AlwPwTlxvG6fcGzWul6ALf7BIzjjAw6R8jjd+OpkuMbFVUkxb6JcbWzaXnLSxsFr4YTAPBtxD48JlU2MoaVXxjdepIfNWO8p7oUBKe9b75y4zm35oG/OYFpImuXTCCKDjGn+M2QcENttaV3C/SQZZMvexiOIXbw2hpQ+6bLLHl6xspEx0e17gy7dIQhI6CO+P4/pJ8SCF0fKwQ6+DUEJjH6YmP5mA9lEJPgWIIW8yRjpkqbeyD2+l7hdv16w=~3617329~3753526; Domain=.prada.com; Path=/; Expires=Tue, 23 Dec 2025 07:22:14 GMT; Max-Age=14400; SameSite=None; Secure