Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
Public Swagger UI/API detected at path: /swagger/index.html
Severity: info
Fingerprint: 5733ddf49ff49cd1aad0354959d915974caf5f24a1dd09633dbc454e314276d5
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/About/Version
GET /v1/Licenses
GET /v1/Licenses({key})
GET /v1/Licenses/$count
GET /v1/Licenses/{key}
GET /v1/Products
GET /v1/Products({key})
GET /v1/Products/$count
GET /v1/Products/CheckIfPromotionalSet(offerId={offerId})
GET /v1/Products/Elastic.Licensing.API.CheckIfPromotionalSet(offerId={offerId})
GET /v1/Products/Elastic.Licensing.API.GetProductSubDomain(offerId={offerId})
GET /v1/Products/GetProductSubDomain(offerId={offerId})
GET /v1/Products/{key}
GET /v1/Subscriptions
GET /v1/Subscriptions({key})
GET /v1/Subscriptions/$count
GET /v1/Subscriptions/Elastic.Licensing.API.GetOrganizationsWithProducts
GET /v1/Subscriptions/GetOrganizationsWithProducts
GET /v1/Subscriptions/{key}
POST /v1/Subscriptions/Assign
POST /v1/Subscriptions/AssignGroups
POST /v1/Subscriptions/Elastic.Licensing.API.Assign
POST /v1/Subscriptions/Elastic.Licensing.API.AssignGroups
POST /v1/Subscriptions/Elastic.Licensing.API.IsOfferAlreadyInUseByOrganization
POST /v1/Subscriptions/Elastic.Licensing.API.Modify
POST /v1/Subscriptions/Elastic.Licensing.API.ModifyGroups
POST /v1/Subscriptions/Elastic.Licensing.API.Unassign
POST /v1/Subscriptions/Elastic.Licensing.API.UnassignGroups
POST /v1/Subscriptions/IsOfferAlreadyInUseByOrganization
POST /v1/Subscriptions/Modify
POST /v1/Subscriptions/ModifyGroups
POST /v1/Subscriptions/Unassign
POST /v1/Subscriptions/UnassignGroups