Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1aad035493f84a93307e737934c4232ba931c69859c5f3d36
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
DELETE /ConfigurableFields/partnerFields/{id}
DELETE /DocumentTemplates/{configurableFieldId}/DeleteColumnsByConfigurableField
DELETE /DocumentTemplates/{documentTemplateId}/Delete
DELETE /Layouts/delete
DELETE /SystemSettings/ActionRulesSettings/{id}
GET /AuditViewer/InitAuditViewerControls
GET /Certificates
GET /Certificates/getcertificatenameprefix
GET /CommunityPortals/LinkedSystems
GET /CommunityPortals/LinkedSystems/SharingSettings/{portalId}
GET /CommunityPortals/businessPortal/{portalId}
GET /CommunityPortals/emailMessageTemplateDetails/{portalId}/{messageTemplateOwner}/{messageTemplateId}
GET /CommunityPortals/enum/{enumName}
GET /CommunityPortals/investigateLinking/{portalId}
GET /CommunityPortals/messageTemplates/{portalId}
GET /CommunityPortals/partnerPortal/{portalId}
GET /CommunityPortals/publicPortal/{portalId}
GET /CommunityPortals/smsMessageTemplateDetails/{portalId}/{messageTemplateOwner}/{messageTemplateId}
GET /CommunityPortals/{portalId}/business
GET /CommunityPortals/{portalId}/business/{businessId}
GET /CommunityPortals/{portalId}/business/{businessId}/camera
GET /CommunityPortals/{portalId}/camera/{cameraId}
GET /ConfigurableFields
GET /ConfigurableFields/ActionApprovalRequestFieldDetail
GET /ConfigurableFields/ActionApprovalRequestFieldsList
GET /ConfigurableFields/CaseFieldDetail
GET /ConfigurableFields/CaseFieldList
GET /ConfigurableFields/EssentialClaims
GET /ConfigurableFields/EvidenceFieldDetail
GET /ConfigurableFields/EvidenceFieldList
GET /ConfigurableFields/GetDistinctClaimNames
GET /ConfigurableFields/GetFieldOptions
GET /ConfigurableFields/InvestigateRequestFieldDetail
GET /ConfigurableFields/InvestigateRequestFieldList
GET /ConfigurableFields/NewActionApprovalRequestField
GET /ConfigurableFields/NewCaseField
GET /ConfigurableFields/NewEvidenceField
GET /ConfigurableFields/NewInvestigateRequestField
GET /ConfigurableFields/fieldDetail
GET /ConfigurableFields/mediatypes
GET /ConfigurableFields/partnerEvidenceFieldList
GET /ConfigurableFields/partnerFields
GET /ConfigurableFields/partners
GET /DocumentTemplates
GET /DocumentTemplates/GetKeywords
GET /DocumentTemplates/{configurableFieldId}/ConfigutableFieldUsageInfo
GET /DocumentTemplates/{documentTemplateId}/Download
GET /DocumentTemplates/{documentTemplateId}/GetEvidenceTables
GET /DocumentTemplates/{documentTemplateId}/{draftOnly}/GetActiveDraftDocument
GET /FeatureToggles
GET /Forms
GET /Forms/search-dynamic-fields
GET /Groups
GET /Groups/summaries
GET /Groups/{id}/details
GET /Groups/{id}/userCount
GET /Layouts
GET /Layouts/details/{layoutTemplateId}
GET /NoOp
GET /RequestTypes
GET /RequestTypes/{requestTypeId}
GET /ResourceData/GetResourceData
GET /Roles
GET /Roles/summaries
GET /Roles/{id}/users
GET /SystemSettings/AccessControlSettings
GET /SystemSettings/ActionRulesSettings
GET /SystemSettings/BatesStampingSettings
GET /SystemSettings/EmailDomainsSettings
GET /SystemSettings/FileUploadsSettings
GET /SystemSettings/GeneralSettings
GET /SystemSettings/SharingSettings
GET /Users
GET /Users/{id}
GET /dsg
GET /dsg/AllUsers
GET /dsg/DsgClientInfo
GET /dsg/ManagementMenu
GET /dsg/connectornames
GET /dsg/{dsgName}/connectors
GET /dsg/{dsgName}/healthStatus
GET /dsg/{dsgName}/resilienceState
GET /lookup/groups
GET /lookup/roles
GET /lookup/users
GET /messageTemplates/templateList
GET /messageTemplates/templatedetails/{templateName}
GET /policies
GET /retentionPolicies
GET /service/Health/ping
GET /tag/evidence
GET /tag/evidence/systemTagSettings
GET /tag/tagDefinitionSettings
POST /AuditViewer/exportascsv
POST /AuditViewer/search
POST /AuditViewer/totalrecordcount
POST /Certificates/downloadcertificate
POST /Certificates/generatecertificate
POST /Certificates/{certificateId}/reinstate
POST /Certificates/{certificateId}/revoke
POST /ConfigurableFields/ChangeFieldPosition
POST /ConfigurableFields/ChangePartnerFieldPosition/{partnerConfigurableFieldsId}/{currentPosition}/{destination}
POST /ConfigurableFields/CheckLinkExists/{linkType}/{linkKey}
POST /ConfigurableFields/CreateActionApprovalRequestField
POST /ConfigurableFields/CreateCaseField
POST /ConfigurableFields/CreateEvidenceField
POST /ConfigurableFields/CreateInvestigateRequestField
POST /ConfigurableFields/DeleteActionApprovalRequestField
POST /ConfigurableFields/DeleteCaseField
POST /ConfigurableFields/DeleteEvidenceField
POST /ConfigurableFields/DeleteInvestigateRequestField
POST /ConfigurableFields/EditActionApprovalRequestField
POST /ConfigurableFields/EditCaseField
POST /ConfigurableFields/EditEvidenceField
POST /ConfigurableFields/EditInvestigateRequestField
POST /DocumentTemplates/{documentTemplateId}/Publish
POST /DocumentTemplates/{documentTemplateId}/Rename
POST /Forms/getformDefinition
POST /Groups/create
POST /Groups/{groupId}/delete
POST /Groups/{groupId}/edit
POST /Layouts/create
POST /RequestTypes/updateRequestTypeFormVersion
POST /Roles/{roleId}/delete
POST /Roles/{roleId}/edit
POST /SystemSettings/BatesStampingPreview
POST /Users/{id}/edit
POST /Users/{id}/groups
POST /Users/{id}/roles
POST /dsg/{dsgName}/connectors/retrieveDsgCaseBasedIDs
POST /dsg/{dsgName}/connectors/retrieveDsgCaseBasedTimeFrameLimit
POST /dsg/{dsgName}/resilience
POST /lookup/groupsByIds
POST /lookup/rolesByIds
POST /lookup/usersByIds
POST /policies/delete
POST /policies/download
POST /policies/setActive
POST /retentionPolicies/activate
POST /retentionPolicies/deactivate
POST /retentionPolicies/download
POST /retentionPolicies/downloaddryrunresults
POST /retentionPolicies/dryrun
POST /retentionPolicies/getdryrunstatus
PUT /DocumentTemplates/Create
PUT /DocumentTemplates/SaveAsDraft
PUT /DocumentTemplates/{documentTemplateId}/Upload
PUT /Layouts/update
PUT /Users/{id}/password
PUT /policies/upload
PUT /retentionPolicies/upload
PUT /tag/evidence/restore
Open service 13.80.19.74:443 · shareinv25tc-admin.nidemo.com
2026-01-23 14:03
HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Fri, 23 Jan 2026 14:03:39 GMT Location: https://shareinv25tc-login.nidemo.com/connect/authorize?client_id=shareinv25tc-admin&redirect_uri=https%3A%2F%2Fshareinv25tc-admin.nidemo.com%2F&response_type=code&scope=openid%20profile%20dynamicclaims%20agency&code_challenge=DuOEefv9tta8AsPHkzZO7Z1RC1mN53BXCPXMNqWhGrw&code_challenge_method=S256&response_mode=form_post&nonce=639047738201807800.YzRhZjA3ZjUtYTcxMS00NDg1LTg2NDQtMmUwODE0MGM3YzFmZGE5NjQzZWUtZGEzNS00N2NlLWI4MTItODViZTM5N2E1OGU5&prompt=login&state=CfDJ8ARLfR36oAdIiTS6j_LZ3JOqRWMXoU6X8CVEi9HbzV_N87MApNSQ1cRO7yLnP1pIiItbJJO_EKvK0ES-W9TyLVRE-D5nAHibdUALcVfcDNPUD2uZL1nOZ7sVBOpg2Tpq46wuv_dJlJhtSMLn3UFfKdXuaJ1AmK2-UznPO2R8RW732zUECKaF-GUhsubqXonDPuzBhaIvzaqmoJFJJfSubgOjiinJ6eqn4FuW8rbAxZlphfFxoDPCLLTy0WYGOXwgNaBFBUcEZRhbgfimAMhoAFltYW4Mwp2BRUc47xHiV1i51ly4A3hh8wcSxgjUrUK3lgQ_RDhkUNCPi-FJK4QMzyv4YVf7nrvCfZpkv5kkWRkROOlQ0OaWQXzfiBZ_LXerHA&x-client-SKU=ID_NET8_0&x-client-ver=8.0.1.0 Set-Cookie: .AspNetCore.OpenIdConnect.Nonce.CfDJ8ARLfR36oAdIiTS6j_LZ3JOo4TNpsiiB__oH3qJSpIhLrgn6XnsYLLc6EHdIbROjnxnDonbXXT94GJ3VXtB1EaqBZBZQlhjK3-ZPjDR89DqGPmtBSEhNg-G16M9o5Rq_a8YcF4yDDvHVA7V87lLR8aGA_OjgiZhWirpd7htmD5rHqHwH_FpQJi464bWujUzxf7B-j9SZPAb9ZL_UIEBMpIAba6vMQeX77428zo0WVoQnOgqU9MYTO6lofDEzo_Foj_ehpdeKpXfcMd3kQjCggMY=N; expires=Fri, 23 Jan 2026 14:18:40 GMT; path=/; secure; samesite=none; httponly Set-Cookie: .AspNetCore.Correlation.BiHWG2RX8zIo6sTvxWob36zg-v2geyLn89vxOWgFeow=N; expires=Fri, 23 Jan 2026 14:18:40 GMT; path=/; secure; samesite=none; httponly Strict-Transport-Security: max-age=2592000 Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline' https://cdn.form.io; font-src 'self' data:; frame-ancestors 'self'; form-action 'self'; base-uri 'self'; img-src 'self' data: blob:; script-src 'self' 'unsafe-eval' blob: https://cdn.form.io/; upgrade-insecure-requests; block-all-mixed-content X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: NOSNIFF Feature-Policy: speaker 'none'; geolocation 'none'; microphone 'none'; autoplay 'none'; camera 'none' Permissions-Policy: speaker=(), geolocation=(), microphone=(), autoplay=(), camera=()
Open service 13.80.19.74:443 · shareinv25tc-admin.nidemo.com
2026-01-09 15:20
HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Fri, 09 Jan 2026 15:21:08 GMT Location: https://shareinv25tc-login.nidemo.com/connect/authorize?client_id=shareinv25tc-admin&redirect_uri=https%3A%2F%2Fshareinv25tc-admin.nidemo.com%2F&response_type=code&scope=openid%20profile%20dynamicclaims%20agency&code_challenge=m6Ygar4sNf4jzOPW8qDYSTpJWxsLe4mGLgT8z19_yRY&code_challenge_method=S256&response_mode=form_post&nonce=639035688693737056.NDYzZDZjNzMtZjk2ZC00MjY5LWJkYTUtNTZlYzYwNzk0ZDZmYWM0ODRjNzctYzUxZC00ZjZjLWIwZWItZDkwMjk4OGRkMWIw&prompt=login&state=CfDJ8ARLfR36oAdIiTS6j_LZ3JNBgD_HyZsavHp7BHBVNlFvdMBAmuGEIZc4g7821jYfmn_gQKv8yN31yzHBOO5GRqPY9Ac72nRfnETX9CcmsRiHxKia-xRRWlwoLtHPu2NCFdbkSQeSisbOKOM3F1p0OWrxFARv72vwr9dYLlh8MOvfCA2U0X1AJqwTaZmjL5-TiOMJDtxMvyTZZMwP6sh3SWDa2_RV601F-x9gIFt1MDCU0aW0p4jKPDbsZyw1OFJD3oOlVPXZvjCIqMquYgDaMkvRK7eIq-D17UrIxeMGJjskEzU9qsEicIPMfZ7HrivOqOk5PI3DZNu3GCn-1dhUe3g2aC6zm6m-pti0h_u_hqS4kV2L7IPsSlZS7tmS4_sZNw&x-client-SKU=ID_NET8_0&x-client-ver=8.0.1.0 Set-Cookie: .AspNetCore.OpenIdConnect.Nonce.CfDJ8ARLfR36oAdIiTS6j_LZ3JOj4_QB86u1tumZYhw0mzd6N0V_bMJc0eDaU4aTkKhDKUAvT0a5ttvZbUjRhn3NJJwy5iE-7R91a2LWuiNsoJYGZ-9-WcThAXmT9uH-OXbqJh1TdYYywdxb7K7Z9_6j7oAdOR01UhhbC8MMqF4ln8oYAcHh65uDEFoJDh1YzVoWi4E8OfPRZWauOcUZFsFMDgAXxQt2E8QRbzSD02HUzKzrIxXK1YQL3t-E2nHB9dVLrJFfVJAFlW8dtwgqJhVnyHg=N; expires=Fri, 09 Jan 2026 15:36:09 GMT; path=/; secure; samesite=none; httponly Set-Cookie: .AspNetCore.Correlation.giW3mWYUJNqbFWGatV4TRAWAxUy-7Deu7kSP6HB3dgA=N; expires=Fri, 09 Jan 2026 15:36:09 GMT; path=/; secure; samesite=none; httponly Strict-Transport-Security: max-age=2592000 Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline' https://cdn.form.io; font-src 'self' data:; frame-ancestors 'self'; form-action 'self'; base-uri 'self'; img-src 'self' data: blob:; script-src 'self' 'unsafe-eval' blob: https://cdn.form.io/; upgrade-insecure-requests; block-all-mixed-content X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: NOSNIFF Feature-Policy: speaker 'none'; geolocation 'none'; microphone 'none'; autoplay 'none'; camera 'none' Permissions-Policy: speaker=(), geolocation=(), microphone=(), autoplay=(), camera=()
Open service 13.80.19.74:443 · shareinv25tc-admin.nidemo.com
2026-01-02 17:34
HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Fri, 02 Jan 2026 17:34:21 GMT Location: https://shareinv25tc-login.nidemo.com/connect/authorize?client_id=shareinv25tc-admin&redirect_uri=https%3A%2F%2Fshareinv25tc-admin.nidemo.com%2F&response_type=code&scope=openid%20profile%20dynamicclaims%20agency&code_challenge=-ySyl7sVGpqNPMLherUiw89zEQr-5kaYgIVTswZHDdY&code_challenge_method=S256&response_mode=form_post&nonce=639029720619830819.OWZjY2ExMjYtZDNjMi00MTYwLWJkYmUtNDQ1YmI5MDBkYzAzN2JhMzJkOWEtY2NhZi00NThkLTk3ZGYtMTkwMjE2MjVhNTIy&prompt=login&state=CfDJ8ARLfR36oAdIiTS6j_LZ3JOJuyFXTiQBjv5D_xDBtkrBOH1KYQKmsDfekVtoSmgn17PRYZfZNblGy3sZHLss8MQeF3EswIYIqhSv8sdDBQpN-YQGEHqRQYJWq8SDk7pSJFCc9vtOA1_e7HF73qF6km2hzXyMZDs9f-4W4DpfXrfi1oejqqHMmkZok-wOdBPRvVxknCfx6f0EZuBX22r2tsLItTktRbR-FOLe0ZuJEXrCg4x0-tamxCFpYVZv5HF_X7dpMcYnzOcpEMvBnV1em31EUt-hYezus-Gfo1PJ4bzLVi-xQDu7QjVDs13p8cBBqwbF6noqznlYeiFg8lvtsadQUPnidTmbie4Cs4cKf81R5eomfXy5ONxyJUrinluPVA&x-client-SKU=ID_NET8_0&x-client-ver=8.0.1.0 Set-Cookie: .AspNetCore.OpenIdConnect.Nonce.CfDJ8ARLfR36oAdIiTS6j_LZ3JMbC1adz8LxVgu568IvLODEYcv_E7uGE6C8SCEPFLfpfHVIUP9KCqk2wrjj2t1K4ymrF69mI5AMm4EA-CfcJd3KDDvXuw7MdilP01j2Px406R1fnt0g9fnAj51cO1oL9i3EKSwtA3ah5cdGNNghb4gxSVTs2gMa5_RRH4Jhx0DC5TC7CKwk3ZJOd6_k42_x-fSqMZAGh4eiXaknzovuMOQ0n0kWpQKNwgvfru6pEgnX91LahTQDLi6fleqlLMIGOrQ=N; expires=Fri, 02 Jan 2026 17:49:21 GMT; path=/; secure; samesite=none; httponly Set-Cookie: .AspNetCore.Correlation.rvXtaO6vlqZYw4qO4q69reKcwhPT8MU-xFmVDhacZV0=N; expires=Fri, 02 Jan 2026 17:49:21 GMT; path=/; secure; samesite=none; httponly Strict-Transport-Security: max-age=2592000 Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline' https://cdn.form.io; font-src 'self' data:; frame-ancestors 'self'; form-action 'self'; base-uri 'self'; img-src 'self' data: blob:; script-src 'self' 'unsafe-eval' blob: https://cdn.form.io/; upgrade-insecure-requests; block-all-mixed-content X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: NOSNIFF Feature-Policy: speaker 'none'; geolocation 'none'; microphone 'none'; autoplay 'none'; camera 'none' Permissions-Policy: speaker=(), geolocation=(), microphone=(), autoplay=(), camera=()
Open service 13.80.19.74:80 · shareinv25tc-admin.nidemo.com
2026-01-02 17:34
HTTP/1.1 301 Moved Permanently Content-Length: 0 Connection: close Date: Fri, 02 Jan 2026 17:34:21 GMT Location: https://shareinv25tc-admin.nidemo.com/