Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549134ce4712c8ecc89729ab71ea4a3509f7d59c80b
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /admin/api/app-file/{fileId}
GET /admin/api/app-file/{filePath}/{fileId}
GET /api/diia/deeplink/{requestId}
GET /api/diia/goto-deeplink/{requestId}
GET /api/diia/share-requests/{requestId}/documents/{accessToken}/attachments
GET /api/diia/share-status/{requestId}
GET /api/lead/application-form/document/{documentId}
GET /api/lead/get-grm-by-eic-code
GET /api/lead/get-lead-status
GET /api/locations/get_addr_house_by_street_id
GET /api/locations/get_city_by_region_id_and_district_id_and_city_ua
GET /api/locations/get_districts_by_region_id_and_district_ua
GET /api/locations/get_regions_by_region_ua
GET /api/locations/get_street_by_region_id_and_district_id_and_city_id_and_street_ua
GET /sitemap.xml
GET /{locale}/api/get-news
POST /admin/api/app-file
POST /api/lead/change-provider/documents/{documentId}/sand-without-signed-document
POST /api/lead/change-provider/documents/{documentId}/save-signed-document
POST /api/lead/landings/forms/interests
POST /api/lead/save-application-form
POST /requestform
Severity: info
Fingerprint: 5733ddf49ff49cd1f3d88d60d6c915f85f13f15ed54805a1021767fa56a655ae
Public Swagger UI/API detected at path: /swagger/v1/swagger.json - sample paths:
GET /admin/api/app-file/{fileId}
GET /admin/api/app-file/{filePath}/{fileId}
GET /api/diia/deeplink/{requestId}
GET /api/diia/goto-deeplink/{requestId}
GET /api/diia/share-requests/{requestId}/documents/{accessToken}/attachments
GET /api/diia/share-status/{requestId}
GET /api/lead/application-form/document/{documentId}
GET /api/lead/get-grm-by-eic-code
GET /api/lead/get-lead-status
GET /api/locations/get_addr_house_by_street_id
GET /api/locations/get_city_by_region_id_and_district_id_and_city_ua
GET /api/locations/get_districts_by_region_id_and_district_ua
GET /api/locations/get_regions_by_region_ua
GET /api/locations/get_street_by_region_id_and_district_id_and_city_id_and_street_ua
GET /sitemap.xml
GET /{locale}/api/get-news
POST /admin/api/app-file
POST /api/lead/change-provider/documents/{documentId}/sand-without-signed-document
POST /api/lead/change-provider/documents/{documentId}/save-signed-document
POST /api/lead/landings/forms/interests
POST /api/lead/save-application-form
POST /requestform
Severity: info
Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
Public Swagger UI/API detected at path: /swagger/index.html