GraphQL introspection is enabled.
This could leak to data leak if not properly configured.
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa30617a62f6896ad7dfa4525aee741e645f19f5f41
GraphQL introspection enabled at /graphql Types: 145 (by kind: ENUM: 8, INPUT_OBJECT: 42, OBJECT: 88, SCALAR: 7) Operations: - Query: Query | fields: _schemaDefinition, earliestLatestSpend, facilitiesByOrgId, facilitiesWithSpend, supplierNoContractSpendPercent - Mutation: Mutation | fields: addTier2SupplierManualSpend, deleteTier2SupplierManualSpend, editTier2SupplierManualSpend, exportTransactions Directives: include, skip (total: 2)
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa37079947c16c51fc0eb5694d13dbf841e0ba776c2
GraphQL introspection enabled at /graphql Types: 137 (by kind: ENUM: 8, INPUT_OBJECT: 42, OBJECT: 80, SCALAR: 7) Operations: - Query: Query | fields: _schemaDefinition, earliestLatestSpend, facilitiesByOrgId, facilitiesWithSpend, supplierNoContractSpendPercent - Mutation: Mutation | fields: addTier2SupplierManualSpend, deleteTier2SupplierManualSpend, editTier2SupplierManualSpend, exportTransactions Directives: include, skip (total: 2)
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa35ebda3cfe007f75dd6c99bce9daae9a5aaa8d3e1
GraphQL introspection enabled at /graphql Types: 124 (by kind: ENUM: 8, INPUT_OBJECT: 37, OBJECT: 72, SCALAR: 7) Operations: - Query: Query | fields: _schemaDefinition, earliestLatestSpend, facilitiesByOrgId, facilitiesWithSpend, supplierNoContractSpendPercent - Mutation: Mutation | fields: addTier2SupplierManualSpend, deleteTier2SupplierManualSpend, editTier2SupplierManualSpend, exportTransactions Directives: include, skip (total: 2)
Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1f3d88d6039dbecbf9fb2805a7328ce0e90e1a255358bb443
Public Swagger UI/API detected at path: /swagger/v1/swagger.json - sample paths:
GET /api/Analytics/CategoryDeepDiveSpendSummary
GET /api/Analytics/CatgeoryDeepDiveSpendSummary
GET /api/Analytics/FacilityGroups
GET /api/Analytics/OverviewSpendFilters
GET /api/Analytics/analyticsAdmins
GET /api/Analytics/categoryList
GET /api/Analytics/reCategorizations
GET /api/Analytics/rolling12
GET /api/Benchmark/BenchmarkFilters
GET /api/Diversity/Filters
GET /api/Diversity/metrics
GET /api/Insights/filters
GET /api/Spend/changes
GET /api/Spend/consolidation
GET /api/Spend/lastRefreshDate
GET /api/Spend/recurring
GET /api/Spend/spendtotal
GET /api/SupplierPerformance/CreateKPIData
GET /api/SupplierPerformance/categorysuppliers
GET /api/SupplierPerformance/suppliercount
GET /api/SupplierPerformance/suppliersbycategory
GET /api/spend/summary/category/{categoryId}
GET /api/spend/summary/category/{category}
POST /api/Analytics/CategoryDeepDiveSpendSummaryDiversity
POST /api/Analytics/categories/{organizationId}
POST /api/Analytics/categorySuppliers
POST /api/Analytics/changesOverTime
POST /api/Analytics/completedReCategorizations
POST /api/Analytics/dataOfCategoriesAnalyzed
POST /api/Analytics/dataOfSuppliersAnalyzed
POST /api/Analytics/reCategorizationParams
POST /api/Analytics/reCategorizationSubmit
POST /api/Analytics/spendbreakdown
POST /api/Analytics/suppliers
POST /api/Analytics/transactions
POST /api/Analytics/transactionsAsync
POST /api/Benchmark/categorySavings
POST /api/Benchmark/facilitySavings
POST /api/Diversity
POST /api/Diversity/spendTrend
POST /api/Diversity/supplier
POST /api/SpendRecords/stats
POST /api/SupplierPerformance/supplierprofilespenddata
POST /api/SupplierPerformance/supplierprofilespenddatabycategory
Open service 2620:1ec:46::44:80 · mp-services-spend.prod.conductiv.app
2026-02-03 10:16
HTTP/1.1 307 Temporary Redirect Date: Tue, 03 Feb 2026 10:16:17 GMT Content-Type: text/html Content-Length: 0 Connection: close Location: https://mp-services-spend.prod.conductiv.app/ x-azure-ref: 20260203T101617Z-17555644bff4ps9rhC1FRA5c9g0000000ptg000000001d36 X-Cache: CONFIG_NOCACHE
Open service 13.107.246.44:443 · mp-services-spend.prod.conductiv.app
2026-01-22 12:10
HTTP/1.1 301 Moved Permanently Date: Thu, 22 Jan 2026 12:10:44 GMT Content-Length: 0 Connection: close Location: index.html Request-Context: appId=cid-v1:31021c2c-4bdd-4845-92d3-32a0540f3f9f Strict-Transport-Security: max-age=31536000; includeSubDomains x-azure-ref: 20260122T121043Z-15dc44c76d4wr77rhC1SG1sdpc00000002600000000075pf X-Cache: CONFIG_NOCACHE
Open service 13.107.246.44:443 · mp-services-spend.prod.conductiv.app
2026-01-22 12:10
HTTP/1.1 301 Moved Permanently Date: Thu, 22 Jan 2026 12:10:44 GMT Content-Length: 0 Connection: close Location: index.html Request-Context: appId=cid-v1:31021c2c-4bdd-4845-92d3-32a0540f3f9f Strict-Transport-Security: max-age=31536000; includeSubDomains x-azure-ref: 20260122T121043Z-15dc44c76d4sgbf4hC1SG1hd2800000003e0000000003yxd X-Cache: CONFIG_NOCACHE
Open service 13.107.246.44:443 · mp-services-spend.prod.conductiv.app
2026-01-10 01:14
HTTP/1.1 301 Moved Permanently Date: Sat, 10 Jan 2026 01:14:45 GMT Content-Length: 0 Connection: close Location: index.html Request-Context: appId=cid-v1:31021c2c-4bdd-4845-92d3-32a0540f3f9f Strict-Transport-Security: max-age=31536000; includeSubDomains x-azure-ref: 20260110T011444Z-r17955489d5wxp5rhC1FRA9x440000000bbg0000000018tu X-Cache: CONFIG_NOCACHE
Open service 13.107.246.44:443 · mp-services-spend.prod.conductiv.app
2026-01-10 01:14
HTTP/1.1 301 Moved Permanently Date: Sat, 10 Jan 2026 01:14:45 GMT Content-Length: 0 Connection: close Location: index.html Request-Context: appId=cid-v1:31021c2c-4bdd-4845-92d3-32a0540f3f9f Strict-Transport-Security: max-age=31536000; includeSubDomains x-azure-ref: 20260110T011444Z-17bcc8785fcc442whC1FRAp55c00000008g000000000a6zx X-Cache: CONFIG_NOCACHE