Varnish
tcp/443
Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1b885ff431e6a60e135bcb8bd3921adfe564bd076c7659e1e
Public Swagger UI/API detected at path: /swagger.json - sample paths: GET /api/ GET /api/404 GET /api/callback GET /api/claimpower/billing/patient_search GET /api/claimpower/flag GET /api/claimpower/patient GET /api/claimpower/patient_calls GET /api/claimpower/patient_calls/patient GET /api/claimpower/transfer/get_patient_info GET /api/claimpower/transfer/transfer_encounter GET /api/claimpower/ui/settings GET /api/doc GET /api/echo/pulse GET /api/extensions/?name GET /api/fhir/observation/ GET /api/fhir/patient/?id GET /api/fhir/questionnaire/?id GET /api/healthcheck GET /api/resources/?name GET /api/resources/Patient GET /api/systems/?name GET /api/teapot POST /api/auth/token POST /api/auth/userinfo POST /api/claimpower/billing/get_census_info POST /api/claimpower/billing/patient POST /api/claimpower/fhir POST /api/claimpower/forms/pdf POST /api/claimpower/forms/pdf/id POST /api/claimpower/forms/upload POST /api/claimpower/patient/ebill POST /api/claimpower/patient/get POST /api/claimpower/patient/get_form_url POST /api/claimpower/patient/get_ui_url POST /api/claimpower/redirect POST /api/claimpower/tests POST /api/claimpower/wrapper POST /api/og POST /api/phasezero
Open service 151.101.193.242:443 · devapi.medplum.claimpower.com
2026-02-12 12:05
HTTP/1.1 500 Domain Not Found Connection: close Content-Length: 296 Server: Varnish Retry-After: 0 content-type: text/html Cache-Control: private, no-cache X-Served-By: cache-yyz4566-YYZ Accept-Ranges: bytes Date: Thu, 12 Feb 2026 12:05:47 GMT Via: 1.1 varnish Page title: Fastly error: unknown domain devapi.medplum.claimpower.com <html> <head> <title>Fastly error: unknown domain devapi.medplum.claimpower.com</title> </head> <body> <p>Fastly error: unknown domain: devapi.medplum.claimpower.com. Please check that this domain has been added to a service.</p> <p>Details: cache-yyz4566-YYZ (151.101.193.242)</p></body></html>
Open service 151.101.129.242:443 · devapi.medplum.claimpower.com
2026-02-12 12:05
HTTP/1.1 500 Domain Not Found Connection: close Content-Length: 304 Server: Varnish Retry-After: 0 content-type: text/html Cache-Control: private, no-cache X-Served-By: cache-lcy-egml8630084-LCY Accept-Ranges: bytes Date: Thu, 12 Feb 2026 12:05:47 GMT Via: 1.1 varnish Page title: Fastly error: unknown domain devapi.medplum.claimpower.com <html> <head> <title>Fastly error: unknown domain devapi.medplum.claimpower.com</title> </head> <body> <p>Fastly error: unknown domain: devapi.medplum.claimpower.com. Please check that this domain has been added to a service.</p> <p>Details: cache-lcy-egml8630084-LCY (151.101.129.242)</p></body></html>
Open service 2a04:4e42:200::498:443 · devapi.medplum.claimpower.com
2026-01-23 13:01
HTTP/1.1 200 OK Connection: close Content-Length: 2 x-ratelimit-remaining: 59999 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload content-type: text/plain; charset=utf-8 permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=() cache-control: no-store, no-cache, must-revalidate x-content-type-options: nosniff x-ratelimit-limit: 60000 x-ratelimit-reset: 1769173359 referrer-policy: no-referrer pragma: no-cache content-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; x-frame-options: DENY Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 23 Jan 2026 13:01:43 GMT Age: 1 X-Served-By: cache-iad-kjyo7100151-IAD, cache-iad-kjyo7100153-IAD, cache-lga21956-LGA X-Cache: MISS, HIT, HIT X-Cache-Hits: 0, 2, 1 X-Timer: S1769173303.227603,VS0,VE1 Vary: Accept-Encoding OK
Open service 2a04:4e42::498:80 · devapi.medplum.claimpower.com
2026-01-23 13:01
HTTP/1.1 200 OK Connection: close Content-Length: 2 x-ratelimit-remaining: 59999 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload content-type: text/plain; charset=utf-8 permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=() cache-control: no-store, no-cache, must-revalidate x-content-type-options: nosniff x-ratelimit-limit: 60000 x-ratelimit-reset: 1769173359 referrer-policy: no-referrer pragma: no-cache content-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; x-frame-options: DENY Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 23 Jan 2026 13:01:43 GMT Age: 1 X-Served-By: cache-iad-kjyo7100151-IAD, cache-iad-kjyo7100153-IAD, cache-pao-kpao1770027-PAO X-Cache: MISS, HIT, HIT X-Cache-Hits: 0, 7, 1 X-Timer: S1769173303.233400,VS0,VE87 Vary: Accept-Encoding OK
Open service 151.101.193.242:443 · devapi.medplum.claimpower.com
2026-01-23 13:01
HTTP/1.1 200 OK Connection: close Content-Length: 2 x-ratelimit-remaining: 59999 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload content-type: text/plain; charset=utf-8 permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=() cache-control: no-store, no-cache, must-revalidate x-content-type-options: nosniff x-ratelimit-limit: 60000 x-ratelimit-reset: 1769173359 referrer-policy: no-referrer pragma: no-cache content-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; x-frame-options: DENY Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 23 Jan 2026 13:01:42 GMT Age: 5 X-Served-By: cache-iad-kjyo7100151-IAD, cache-iad-kjyo7100153-IAD, cache-fra-eddf8230161-FRA X-Cache: MISS, MISS, HIT X-Cache-Hits: 0, 0, 1 X-Timer: S1769173303.991226,VS0,VE1 Vary: Accept-Encoding OK
Open service 151.101.1.242:443 · devapi.medplum.claimpower.com
2026-01-23 13:01
HTTP/1.1 200 OK Connection: close Content-Length: 2 x-ratelimit-remaining: 59999 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload content-type: text/plain; charset=utf-8 permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=() cache-control: no-store, no-cache, must-revalidate x-content-type-options: nosniff x-ratelimit-limit: 60000 x-ratelimit-reset: 1769173359 referrer-policy: no-referrer pragma: no-cache content-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; x-frame-options: DENY Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 23 Jan 2026 13:01:43 GMT Age: 1 X-Served-By: cache-iad-kjyo7100151-IAD, cache-iad-kjyo7100153-IAD, cache-sjc1000141-SJC X-Cache: MISS, HIT, HIT X-Cache-Hits: 0, 6, 1 X-Timer: S1769173303.236825,VS0,VE200 Vary: Accept-Encoding OK
Open service 2a04:4e42::498:443 · devapi.medplum.claimpower.com
2026-01-23 13:01
HTTP/1.1 200 OK Connection: close Content-Length: 2 x-ratelimit-remaining: 59999 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload content-type: text/plain; charset=utf-8 permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=() cache-control: no-store, no-cache, must-revalidate x-content-type-options: nosniff x-ratelimit-limit: 60000 x-ratelimit-reset: 1769173359 referrer-policy: no-referrer pragma: no-cache content-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; x-frame-options: DENY Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 23 Jan 2026 13:01:43 GMT Age: 1 X-Served-By: cache-iad-kjyo7100151-IAD, cache-iad-kjyo7100153-IAD, cache-pao-kpao1770073-PAO X-Cache: MISS, HIT, HIT X-Cache-Hits: 0, 7, 1 X-Timer: S1769173303.364914,VS0,VE55 Vary: Accept-Encoding OK
Open service 2a04:4e42:200::498:80 · devapi.medplum.claimpower.com
2026-01-23 13:01
HTTP/1.1 200 OK Connection: close Content-Length: 2 x-ratelimit-remaining: 59999 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload content-type: text/plain; charset=utf-8 permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=() cache-control: no-store, no-cache, must-revalidate x-content-type-options: nosniff x-ratelimit-limit: 60000 x-ratelimit-reset: 1769173359 referrer-policy: no-referrer pragma: no-cache content-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; x-frame-options: DENY Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 23 Jan 2026 13:01:44 GMT Age: 2 X-Served-By: cache-iad-kjyo7100151-IAD, cache-iad-kjyo7100153-IAD, cache-sjc1000147-SJC X-Cache: MISS, HIT, HIT X-Cache-Hits: 0, 6, 1 X-Timer: S1769173303.282360,VS0,VE778 Vary: Accept-Encoding OK
Open service 151.101.129.242:443 · devapi.medplum.claimpower.com
2026-01-23 13:01
HTTP/1.1 200 OK Connection: close Content-Length: 2 x-ratelimit-remaining: 59999 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload content-type: text/plain; charset=utf-8 permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=() cache-control: no-store, no-cache, must-revalidate x-content-type-options: nosniff x-ratelimit-limit: 60000 x-ratelimit-reset: 1769173359 referrer-policy: no-referrer pragma: no-cache content-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; x-frame-options: DENY Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 23 Jan 2026 13:01:43 GMT Age: 5 X-Served-By: cache-iad-kjyo7100151-IAD, cache-iad-kjyo7100153-IAD, cache-fra-eddf8230098-FRA X-Cache: MISS, MISS, HIT X-Cache-Hits: 0, 0, 1 X-Timer: S1769173303.003804,VS0,VE2 Vary: Accept-Encoding OK
Open service 2a04:4e42:400::498:443 · devapi.medplum.claimpower.com
2026-01-23 13:01
HTTP/1.1 200 OK Connection: close Content-Length: 2 x-ratelimit-remaining: 59999 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload content-type: text/plain; charset=utf-8 permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=() cache-control: no-store, no-cache, must-revalidate x-content-type-options: nosniff x-ratelimit-limit: 60000 x-ratelimit-reset: 1769173359 referrer-policy: no-referrer pragma: no-cache content-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; x-frame-options: DENY Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 23 Jan 2026 13:01:42 GMT Age: 1 X-Served-By: cache-iad-kjyo7100151-IAD, cache-iad-kjyo7100153-IAD, cache-lga21927-LGA X-Cache: MISS, HIT, HIT X-Cache-Hits: 0, 2, 1 X-Timer: S1769173303.921229,VS0,VE2 Vary: Accept-Encoding OK
Open service 151.101.129.242:80 · devapi.medplum.claimpower.com
2026-01-23 13:01
HTTP/1.1 200 OK Connection: close Content-Length: 2 x-ratelimit-remaining: 59999 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload content-type: text/plain; charset=utf-8 permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=() cache-control: no-store, no-cache, must-revalidate x-content-type-options: nosniff x-ratelimit-limit: 60000 x-ratelimit-reset: 1769173359 referrer-policy: no-referrer pragma: no-cache content-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; x-frame-options: DENY Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 23 Jan 2026 13:01:43 GMT Age: 1 X-Served-By: cache-iad-kjyo7100151-IAD, cache-iad-kjyo7100153-IAD, cache-yyz4566-YYZ X-Cache: MISS, HIT, HIT X-Cache-Hits: 0, 5, 1 X-Timer: S1769173303.201617,VS0,VE2 Vary: Accept-Encoding OK
Open service 2a04:4e42:400::498:80 · devapi.medplum.claimpower.com
2026-01-23 13:01
HTTP/1.1 200 OK Connection: close Content-Length: 2 x-ratelimit-remaining: 59999 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload content-type: text/plain; charset=utf-8 permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=() cache-control: no-store, no-cache, must-revalidate x-content-type-options: nosniff x-ratelimit-limit: 60000 x-ratelimit-reset: 1769173359 referrer-policy: no-referrer pragma: no-cache content-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; x-frame-options: DENY Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 23 Jan 2026 13:01:43 GMT Age: 2 X-Served-By: cache-iad-kjyo7100151-IAD, cache-iad-kjyo7100153-IAD, cache-lcy-egml8630071-LCY X-Cache: MISS, HIT, HIT X-Cache-Hits: 0, 3, 1 X-Timer: S1769173303.462396,VS0,VE55 Vary: Accept-Encoding OK
Open service 2a04:4e42:600::498:80 · devapi.medplum.claimpower.com
2026-01-23 13:01
HTTP/1.1 200 OK Connection: close Content-Length: 2 x-ratelimit-remaining: 59999 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload content-type: text/plain; charset=utf-8 permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=() cache-control: no-store, no-cache, must-revalidate x-content-type-options: nosniff x-ratelimit-limit: 60000 x-ratelimit-reset: 1769173359 referrer-policy: no-referrer pragma: no-cache content-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; x-frame-options: DENY Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 23 Jan 2026 13:01:43 GMT Age: 1 X-Served-By: cache-iad-kjyo7100151-IAD, cache-iad-kjyo7100153-IAD, cache-lcy-egml8630091-LCY X-Cache: MISS, HIT, HIT X-Cache-Hits: 0, 3, 1 X-Timer: S1769173303.987206,VS0,VE56 Vary: Accept-Encoding OK
Open service 151.101.65.242:443 · devapi.medplum.claimpower.com
2026-01-23 13:01
HTTP/1.1 200 OK Connection: close Content-Length: 2 x-ratelimit-remaining: 59999 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload content-type: text/plain; charset=utf-8 permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=() cache-control: no-store, no-cache, must-revalidate x-content-type-options: nosniff x-ratelimit-limit: 60000 x-ratelimit-reset: 1769173359 referrer-policy: no-referrer pragma: no-cache content-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; x-frame-options: DENY Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 23 Jan 2026 13:01:43 GMT Age: 5 X-Served-By: cache-iad-kjyo7100151-IAD, cache-iad-kjyo7100153-IAD, cache-fra-eddf8230190-FRA X-Cache: MISS, MISS, HIT X-Cache-Hits: 0, 0, 1 X-Timer: S1769173303.249794,VS0,VE5 Vary: Accept-Encoding OK
Open service 2a04:4e42:600::498:443 · devapi.medplum.claimpower.com
2026-01-23 13:01
HTTP/1.1 200 OK Connection: close Content-Length: 2 x-ratelimit-remaining: 59999 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload content-type: text/plain; charset=utf-8 permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=() cache-control: no-store, no-cache, must-revalidate x-content-type-options: nosniff x-ratelimit-limit: 60000 x-ratelimit-reset: 1769173359 referrer-policy: no-referrer pragma: no-cache content-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; x-frame-options: DENY Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 23 Jan 2026 13:01:43 GMT Age: 5 X-Served-By: cache-iad-kjyo7100151-IAD, cache-iad-kjyo7100153-IAD, cache-fra-eddf8230114-FRA X-Cache: MISS, MISS, HIT X-Cache-Hits: 0, 0, 1 X-Timer: S1769173303.060102,VS0,VE1 Vary: Accept-Encoding OK
Open service 151.101.193.242:80 · devapi.medplum.claimpower.com
2026-01-23 13:01
HTTP/1.1 200 OK Connection: close Content-Length: 2 x-ratelimit-remaining: 59999 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload content-type: text/plain; charset=utf-8 permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=() cache-control: no-store, no-cache, must-revalidate x-content-type-options: nosniff x-ratelimit-limit: 60000 x-ratelimit-reset: 1769173359 referrer-policy: no-referrer pragma: no-cache content-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; x-frame-options: DENY Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 23 Jan 2026 13:01:43 GMT Age: 1 X-Served-By: cache-iad-kjyo7100151-IAD, cache-iad-kjyo7100153-IAD, cache-yyz4577-YYZ X-Cache: MISS, HIT, HIT X-Cache-Hits: 0, 5, 1 X-Timer: S1769173303.062515,VS0,VE2 Vary: Accept-Encoding OK
Open service 151.101.1.242:80 · devapi.medplum.claimpower.com
2026-01-23 13:01
HTTP/1.1 200 OK Connection: close Content-Length: 2 x-ratelimit-remaining: 59999 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload content-type: text/plain; charset=utf-8 permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=() cache-control: no-store, no-cache, must-revalidate x-content-type-options: nosniff x-ratelimit-limit: 60000 x-ratelimit-reset: 1769173359 referrer-policy: no-referrer pragma: no-cache content-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; x-frame-options: DENY Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 23 Jan 2026 13:01:42 GMT Age: 1 X-Served-By: cache-iad-kjyo7100151-IAD, cache-iad-kjyo7100153-IAD, cache-lga21935-LGA X-Cache: MISS, HIT, HIT X-Cache-Hits: 0, 2, 4 X-Timer: S1769173303.947060,VS0,VE0 Vary: Accept-Encoding OK
Open service 151.101.65.242:80 · devapi.medplum.claimpower.com
2026-01-23 13:01
HTTP/1.1 200 OK Connection: close Content-Length: 2 x-ratelimit-remaining: 59999 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload content-type: text/plain; charset=utf-8 permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=() cache-control: no-store, no-cache, must-revalidate x-content-type-options: nosniff x-ratelimit-limit: 60000 x-ratelimit-reset: 1769173359 referrer-policy: no-referrer pragma: no-cache content-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; x-frame-options: DENY Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 23 Jan 2026 13:01:42 GMT Age: 1 X-Served-By: cache-iad-kjyo7100151-IAD, cache-iad-kjyo7100153-IAD, cache-rtm-ehrd2290029-RTM X-Cache: MISS, HIT, HIT X-Cache-Hits: 0, 1, 1 X-Timer: S1769173303.938959,VS0,VE1 Vary: Accept-Encoding OK