Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549058f0157a1016c246d2aa414bf76b852ab27c538
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
DELETE /Attachment/{attachmentId}
DELETE /Status/subscriptions/{service}
GET /ApiRelease/{apiName}
GET /ApiVersionSets/{versionSetId}
GET /IdentityProviders
GET /PortalSettings/signup
GET /Products
GET /Products/{productName}
GET /Products/{productName}/apis
GET /Reports/ByApi
GET /Reports/ByGeo
GET /Reports/ByOperation
GET /Reports/ByProduct
GET /Reports/ByRequest
GET /Reports/ByTime
GET /Search
GET /Status/subscriptions
GET /Subscriptions
GET /Subscriptions/{subscriptionId}
GET /Tenant/settings
GET /apis
GET /apis/apisByTags
GET /apis/{apiName}
GET /apis/{apiName}/hostnames
GET /apis/{apiName}/operations
GET /apis/{apiName}/operations/{operationName}
GET /apis/{apiName}/operations/{operationName}/tags
GET /apis/{apiName}/operationsByTags
GET /apis/{apiName}/products
GET /apis/{apiName}/releases
GET /apis/{apiName}/schemas
GET /apis/{apiName}/schemas/{schemaId}
GET /email-subscriptions
GET /feature-flags
GET /health-status
GET /health-status-services
GET /identity
GET /refresh-token
POST /Attachment
POST /Subscriptions/{subscriptionId}/listSecrets
POST /Subscriptions/{subscriptionId}/regeneratePrimaryKey
POST /UserForm
POST /support-cases
Open service 2.16.204.85:443 · developerportal-api.csiweb.cloud
2026-01-09 03:23
HTTP/1.1 403 Forbidden Mime-Version: 1.0 Content-Type: text/html Content-Length: 388 Expires: Fri, 09 Jan 2026 03:23:51 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Fri, 09 Jan 2026 03:23:51 GMT Connection: close Strict-Transport-Security: max-age=15768000 ; includeSubDomains Page title: Access Denied <HTML><HEAD> <TITLE>Access Denied</TITLE> </HEAD><BODY> <H1>Access Denied</H1> You don't have permission to access "http://developerportal-api.csiweb.cloud/" on this server.<P> Reference #18.4e1d1002.1767929031.2ff1cce <P>https://errors.edgesuite.net/18.4e1d1002.1767929031.2ff1cce</P> </BODY> </HTML>
Open service 2.16.204.85:443 · developerportal-api.csiweb.cloud
2026-01-02 02:56
HTTP/1.1 403 Forbidden Mime-Version: 1.0 Content-Type: text/html Content-Length: 390 Expires: Fri, 02 Jan 2026 02:56:35 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Fri, 02 Jan 2026 02:56:35 GMT Connection: close Strict-Transport-Security: max-age=15768000 ; includeSubDomains Page title: Access Denied <HTML><HEAD> <TITLE>Access Denied</TITLE> </HEAD><BODY> <H1>Access Denied</H1> You don't have permission to access "http://developerportal-api.csiweb.cloud/" on this server.<P> Reference #18.551d1002.1767322595.c2493c32 <P>https://errors.edgesuite.net/18.551d1002.1767322595.c2493c32</P> </BODY> </HTML>
Open service 2.16.204.85:443 · developerportal-api.csiweb.cloud
2025-12-22 09:33
HTTP/1.1 404 Not Found
Content-Type: application/problem+json; charset=utf-8
Content-Length: 139
Expires: Mon, 22 Dec 2025 09:33:44 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 22 Dec 2025 09:33:44 GMT
Connection: close
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
{"type":"https://httpstatuses.io/404","title":"Not Found","status":404,"traceId":"00-12857cb5e61979f3d8bd966fdaf905b2-ce4f9696e908a008-00"}
Open service 2.16.204.85:443 · developerportal-api.csiweb.cloud
2025-12-20 08:44
HTTP/1.1 404 Not Found
Content-Type: application/problem+json; charset=utf-8
Content-Length: 139
Expires: Sat, 20 Dec 2025 08:44:32 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 20 Dec 2025 08:44:32 GMT
Connection: close
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
{"type":"https://httpstatuses.io/404","title":"Not Found","status":404,"traceId":"00-d62b3e1b6110a897b745405ccac49266-337111d94820cf5a-00"}