Domain dev-api.autm.ai
United Kingdom
MICROSOFT-CORP-MSN-AS-BLOCK
-
Swagger API description is publicly available
Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
First seen 2025-11-19 11:23-
Severity: info
Fingerprint: 5733ddf49ff49cd1aad0354938a48e45ec9bae4c4e3f306cbb2d1b5b77fb6e12Public Swagger UI/API detected at path: /swagger/index.html - sample paths: DELETE /api/WorkflowTrigger/delete DELETE /api/WorkflowTrigger/event-triggers/{triggerId} DELETE /api/url/{shortCode} GET /api/Connections GET /api/Connections/available-services GET /api/Connections/summary GET /api/Memory GET /api/Onboarding/flows-for-route/{route} GET /api/Providers GET /api/Providers/callback/{providerId} GET /api/Providers/{providerId} GET /api/Providers/{providerId}/services GET /api/RedisTest/health GET /api/RedisTest/metrics GET /api/RedisTest/performance GET /api/RedisTest/test-basic GET /api/RedisTest/test-conversation GET /api/RedisTest/test-increment GET /api/RedisTest/test-list GET /api/RedisTest/test-pattern GET /api/ServiceActivation/available GET /api/ServiceActivation/callback/{provider} GET /api/ServiceActivation/scopes GET /api/ServiceActivation/status GET /api/Subscriptions/max-seats GET /api/Test/connections GET /api/Test/service-config GET /api/Translation/usage GET /api/UserBehaviorPreferences GET /api/UserBehaviorPreferences/capabilities GET /api/Users/invite/validate/{token} GET /api/Users/invite/{token} GET /api/Users/me/billing GET /api/Users/me/roles GET /api/WorkflowTrigger GET /api/WorkflowTrigger/event-triggers GET /api/WorkflowTrigger/event-types/{provider} GET /api/WorkflowTrigger/workflow/{workflowId} GET /api/WorkflowTrigger/{triggerId} GET /api/Workflows GET /api/Workflows/available-capabilities GET /api/Workflows/connected-providers GET /api/Workflows/enabled-capabilities GET /api/Workflows/event-types/{provider} GET /api/Workflows/executions GET /api/Workflows/executions/stats GET /api/Workflows/executions/{workflowId} GET /api/Workflows/executions/{workflowId}/stats GET /api/Workflows/{id} GET /api/Workspaces GET /api/Workspaces/current GET /api/Workspaces/current/users GET /api/Workspaces/{workspaceId} GET /api/Workspaces/{workspaceId}/users GET /api/auth/Account/Login GET /api/auth/callback/{provider} GET /api/auth/me GET /api/auth/monitor/db GET /api/config/health GET /api/config/oauth GET /api/events/subscriptions GET /api/events/subscriptions/providers GET /api/events/subscriptions/providers/{provider}/event-types GET /api/events/subscriptions/recent GET /api/events/subscriptions/{subscriptionId} GET /api/events/webhooks/{provider}/verify GET /api/qrcode/url GET /api/qrcode/url/{shortCode} GET /api/signup/auth-provider/{userId} GET /api/signup/business-name/{userId} GET /api/signup/current-plan-name/{userId} GET /api/signup/current-plan/{userId} GET /api/signup/plans GET /api/signup/price/{productId}/{billingCycle} GET /api/signup/setup-intent/{setupIntentId} GET /api/signup/stripe-key GET /api/stripe/Customer GET /api/stripe/Customer/search GET /api/stripe/Customer/{id} GET /api/stripe/Invoice GET /api/stripe/Invoice/subscription/{subscriptionId} GET /api/stripe/Invoice/{invoiceId} GET /api/stripe/Payment GET /api/stripe/Payment/intent/{paymentIntentId}/status GET /api/stripe/Product GET /api/stripe/Product/feature/{lookupKey}/products GET /api/stripe/Product/features GET /api/stripe/Product/{id} GET /api/stripe/Product/{id}/features GET /api/stripe/Subscription/all GET /api/stripe/Subscription/customer/{customerId} GET /api/stripe/Subscription/my-subscription GET /api/stripe/Subscription/my-subscription/features GET /api/stripe/Subscription/my-subscription/seats-summary GET /api/stripe/Subscription/test-features/{productId} GET /api/stripe/Subscription/{subscriptionId} GET /api/stripe/Subscription/{subscriptionId}/features GET /api/stripe/Subscription/{subscriptionId}/invoices GET /api/stripe/Subscription/{subscriptionId}/latest-invoice GET /api/stripe/Subscription/{subscriptionId}/seats-summary GET /api/stripe/docs GET /api/stripe/docs/configuration GET /api/stripe/docs/notifications GET /api/stripe/docs/raw/{filename} GET /api/stripe/docs/readme GET /api/stripe/docs/troubleshooting GET /api/stripe/docs/webhooks GET /api/stripe/price GET /api/stripe/price/product/{productId} GET /api/stripe/price/{id} GET /api/tool-preferences GET /api/tool-preferences/connected/tools GET /api/tool-preferences/workspace-defaults GET /api/tool-preferences/{capability} GET /api/tool-preferences/{capability}/available-providers GET /api/url GET /api/url/{shortCode}/qrcode GET /api/url/{shortCode}/stats GET /healthcheck GET /mcp/tools GET /short/{shortCode} PATCH /api/Providers/services/{serviceId} PATCH /api/Providers/{providerId}/toggle PATCH /api/Workspaces/{workspaceId}/users/{targetUserId} POST /api/Admin/seed-onboarding POST /api/Assistant/messages/stream POST /api/Assistant/messages/workflow-build-stream POST /api/Ingestion/form-file POST /api/Ingestion/text POST /api/Memory/search POST /api/Onboarding/flow/{flowId}/complete POST /api/Onboarding/flow/{flowId}/dismiss POST /api/Onboarding/flow/{flowId}/start POST /api/Onboarding/seed-all POST /api/Providers/{providerId}/apikey POST /api/Providers/{providerId}/complete POST /api/Providers/{providerId}/connect POST /api/ServiceActivation/activate POST /api/ServiceActivation/analyze-scopes POST /api/Test/ingestion POST /api/Tokens/mcp-token POST /api/Tools/schemas POST /api/Translation/detect POST /api/Translation/translate POST /api/UserBehaviorPreferences/batch POST /api/UserBehaviorPreferences/upsert POST /api/Users/invitations/cleanup POST /api/Users/invite POST /api/Users/invite/accept/{token} POST /api/WebhookNotifications/invoices/created POST /api/WebhookNotifications/invoices/payment-failed POST /api/WebhookNotifications/invoices/payment-succeeded POST /api/WebhookNotifications/invoices/sent POST /api/WebhookNotifications/payment-intents/requires-action POST /api/WebhookNotifications/payment-intents/succeeded POST /api/WebhookNotifications/quotes/accepted POST /api/WebhookNotifications/quotes/declined POST /api/WebhookNotifications/quotes/finalized POST /api/WorkflowTrigger/create POST /api/WorkflowTrigger/event POST /api/WorkflowTrigger/validate-cron POST /api/Workflows/activate-workflow-instance POST /api/Workflows/createOrUpdate POST /api/Workspaces/switch/{workspaceId} POST /api/Workspaces/{workspaceId}/users/{targetUserId}/pause POST /api/Workspaces/{workspaceId}/users/{targetUserId}/remove POST /api/auth/authorise POST /api/auth/cleanup/oauth-states POST /api/auth/link-provider POST /api/auth/logout POST /api/auth/token POST /api/events/webhooks/{provider} POST /api/qrcode/generate POST /api/signup/complete POST /api/signup/complete-with-identity POST /api/signup/customer-subscription-dummy POST /api/signup/payment-intent POST /api/signup/payment-intent/plan POST /api/signup/setup-intent POST /api/signup/signup POST /api/signup/store-subscription POST /api/signup/update POST /api/signup/validate POST /api/stripe/Customer/create POST /api/stripe/Invoice/create POST /api/stripe/Payment/confirm-intent POST /api/stripe/Payment/create-intent POST /api/stripe/Payment/test-sms POST /api/stripe/Subscription/create POST /api/stripe/Subscription/link-stripe-customer POST /api/stripe/Subscription/my-subscription/seats POST /api/stripe/Subscription/{subscriptionId}/seats POST /api/stripe/Subscription/{subscriptionId}/swap-base-product POST /api/stripe/webhook/stripe POST /api/url/shorten POST /api/url/shorten-with-qr POST /mcp/tools/{name}:invoke PUT /api/Connections/{id} PUT /api/Subscriptions/billing-cycle PUT /api/WorkflowTrigger/update PUT /api/WorkflowTrigger/{triggerId}/enabled PUT /api/Workspaces/{workspaceId}/users/{targetUserId}/role PUT /api/signup/change-password/{userId} PUT /api/signup/change-plan/{userId} PUT /api/signup/company-name/{userId} PUT /api/signup/personal-details/{userId} PUT /api/tool-preferences/bulkFound on 2025-11-19 11:23
-
-
Open service 20.90.134.37:443 ยท dev-api.autm.ai
2026-01-08 19:12
HTTP/1.1 404 Site Not Found Content-Length: 2667 Connection: close Content-Type: text/html Date: Thu, 08 Jan 2026 19:13:02 GMT Page title: Microsoft Azure Web App - Error 404 <!DOCTYPE html> <html> <head> <title>Microsoft Azure Web App - Error 404</title> <style type="text/css"> html { height: 100%; width: 100%; } #feature { width: 960px; margin: 75px auto 0 auto; overflow: auto; } #content { font-family: "Segoe UI"; font-weight: normal; font-size: 22px; color: #ffffff; float: left; margin-top: 68px; margin-left: 0px; vertical-align: middle; } #content h1 { font-family: "Segoe UI Light"; color: #ffffff; font-weight: normal; font-size: 60px; line-height: 48pt; width: 800px; } a, a:visited, a:active, a:hover { color: #ffffff; } #content a.button { background: #0DBCF2; border: 1px solid #FFFFFF; color: #FFFFFF; display: inline-block; font-family: Segoe UI; font-size: 24px; line-height: 46px; margin-top: 10px; padding: 0 15px 3px; text-decoration: none; } #content a.button img { float: right; padding: 10px 0 0 15px; } #content a.button:hover { background: #1C75BC; } </style> <script type="text/javascript"> function toggle_visibility(id) { var e = document.getElementById(id); if (e.style.display == 'block') e.style.display = 'none'; else e.style.display = 'block'; } </script> </head> <body bgcolor="#00abec"> <div id="feature"> <div id="content"> <h1>404 Web Site not found.</h1> <p>You may be seeing this error due to one of the reasons listed below :</p> <ul> <li>Custom domain has not been configured inside Azure. See <a href="https://go.microsoft.com/fwlink/?linkid=2194614">how to map an existing domain</a> to resolve this.</li> <li>Client cache is still pointing the domain to old IP address. Clear the cache by running the command <i>ipconfig/flushdns.</i></li> </ul> <p>Checkout <a href="https://go.microsoft.com/fwlink/?linkid=2194451">App Service Domain FAQ</a> for more questions.</p> </div> </div> </body> </html>Found 2026-01-08 by HttpPluginCreate report
*.azurewebsites.net*.scm.azurewebsites.net*.sso.azurewebsites.net*.uksouth-01.azurewebsites.net*.scm.uksouth-01.azurewebsites.net*.sso.uksouth-01.azurewebsites.net*.uksouth.c.azurewebsites.net*.scm.uksouth.c.azurewebsites.net*.sso.uksouth.c.azurewebsites.net*.azure-mobile.net*.scm.azure-mobile.net
CN:
*.azurewebsites.net
Not before:
2025-12-25 20:43
Not after:
2026-06-23 20:43