Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd151e75e4b36682a8afd2f898a7107d871185c9be95deda2ad
Public Swagger UI/API detected at path: /v3/api-docs - sample paths:
GET /controller/mirapply/{action}
GET /controller/mirapply/{action}/{requestId}
GET /controller/{action}/{category}/{key}
GET /uicontroller/autocomplete
GET /uicontroller/resource/{technology}/**
GET /xpslight/getCaseId
POST /controller/cryptomodule/{action}/{system}
POST /controller/{action}
POST /controller/{action}/{inputFormat}/{outputFormat}
POST /startXPSheadless
POST /uicontroller/xpsprocess/{technology}/{action}
POST /xpslight/checkCompleteness
POST /xpslight/doSearch
POST /xpslight/doSearchString
POST /xpslight/getCaseResult
POST /xpslight/getPrintResult
POST /xpslight/getUpdatedCaseResult
Severity: info
Fingerprint: 5733ddf49ff49cd151e75e4b36682a8afd2f898a7107d871185c9be9cedc8e31
Public Swagger UI/API detected at path: /v3/api-docs - sample paths:
GET /controller/mirapply/{action}
GET /controller/mirapply/{action}/{requestId}
GET /controller/{action}/{category}/{key}
GET /uicontroller/autocomplete
GET /uicontroller/resource/{technology}/**
GET /xpslight/getCaseId
POST /controller/cryptomodule/{action}/{system}
POST /controller/{action}
POST /controller/{action}/{inputFormat}/{outputFormat}
POST /startLoad
POST /startLoadOnUiService
POST /startXPSheadless
POST /uicontroller/xpsprocess/{technology}/{action}
POST /xpslight/checkCompleteness
POST /xpslight/doSearch
POST /xpslight/doSearchString
POST /xpslight/getCaseResult
POST /xpslight/getPrintResult
POST /xpslight/getUpdatedCaseResult
Open service 23.50.131.139:443 · xpsstandalone-at-qa.allianz.de
2026-01-23 02:17
HTTP/1.1 401 Unauthorized
x-content-type-options: nosniff
x-xss-protection: 0
x-frame-options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' http://localhost:* *.allianz *.allianz.at
Content-Encoding: gzip
Content-Type: application/json
Content-Length: 112
Expires: Fri, 23 Jan 2026 02:17:29 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 23 Jan 2026 02:17:29 GMT
Connection: close
Strict-Transport-Security: max-age=15768000 ; includeSubDomains ; preload
{"timestamp":"2026-01-23T02:17:29.840+00:00","status":401,"error":"Unauthorized","path":"/"}
Open service 23.50.131.139:443 · xpsstandalone-at-qa.allianz.de
2026-01-09 04:02
HTTP/1.1 401 Unauthorized
x-content-type-options: nosniff
x-xss-protection: 0
x-frame-options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' http://localhost:* *.allianz *.allianz.at
Content-Encoding: gzip
Content-Type: application/json
Content-Length: 111
Expires: Fri, 09 Jan 2026 04:02:55 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 09 Jan 2026 04:02:55 GMT
Connection: close
Strict-Transport-Security: max-age=15768000 ; includeSubDomains ; preload
{"timestamp":"2026-01-09T04:02:55.593+00:00","status":401,"error":"Unauthorized","path":"/"}
Open service 23.50.131.139:443 · xpsstandalone-at-qa.allianz.de
2026-01-02 10:53
HTTP/1.1 403 Forbidden Mime-Version: 1.0 Content-Type: text/html Content-Length: 390 Expires: Fri, 02 Jan 2026 10:53:19 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Fri, 02 Jan 2026 10:53:19 GMT Connection: close Strict-Transport-Security: max-age=15768000 ; includeSubDomains ; preload Page title: Access Denied <HTML><HEAD> <TITLE>Access Denied</TITLE> </HEAD><BODY> <H1>Access Denied</H1> You don't have permission to access "http://xpsstandalone-at-qa.allianz.de/" on this server.<P> Reference #18.b173317.1767351199.bb047dd8 <P>https://errors.edgesuite.net/18.b173317.1767351199.bb047dd8</P> </BODY> </HTML>
Open service 2.16.204.81:80 · xpsstandalone-at-qa.allianz.de
2025-12-31 23:17
HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://xpsstandalone-at-qa.allianz.de/ Expires: Wed, 31 Dec 2025 23:17:52 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 31 Dec 2025 23:17:52 GMT Connection: close
Open service 2.16.204.71:443 · xpsstandalone-at-qa.allianz.de
2025-12-31 23:17
HTTP/1.1 503 Service Unavailable Content-Length: 19 Content-Type: text/plain; charset=UTF-8 Expires: Wed, 31 Dec 2025 23:17:49 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 31 Dec 2025 23:17:49 GMT Connection: close Strict-Transport-Security: max-age=15768000 ; includeSubDomains ; preload no healthy upstream
Open service 2a02:26f0:3100::1725:e268:80 · xpsstandalone-at-qa.allianz.de
2025-12-31 23:17
HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://xpsstandalone-at-qa.allianz.de/ Expires: Wed, 31 Dec 2025 23:17:51 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 31 Dec 2025 23:17:51 GMT Connection: close
Open service 2a02:26f0:3100::1725:e25a:80 · xpsstandalone-at-qa.allianz.de
2025-12-31 23:17
HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://xpsstandalone-at-qa.allianz.de/ Expires: Wed, 31 Dec 2025 23:17:51 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 31 Dec 2025 23:17:51 GMT Connection: close
Open service 2a02:26f0:3100::1725:e25a:443 · xpsstandalone-at-qa.allianz.de
2025-12-31 23:17
HTTP/1.1 503 Service Unavailable Content-Length: 19 Content-Type: text/plain; charset=UTF-8 Expires: Wed, 31 Dec 2025 23:17:49 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 31 Dec 2025 23:17:49 GMT Connection: close Strict-Transport-Security: max-age=15768000 ; includeSubDomains ; preload no healthy upstream
Open service 2.16.204.71:80 · xpsstandalone-at-qa.allianz.de
2025-12-31 23:17
HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://xpsstandalone-at-qa.allianz.de/ Expires: Wed, 31 Dec 2025 23:17:52 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 31 Dec 2025 23:17:52 GMT Connection: close
Open service 2.16.204.81:443 · xpsstandalone-at-qa.allianz.de
2025-12-31 23:17
HTTP/1.1 503 Service Unavailable Content-Length: 19 Content-Type: text/plain; charset=UTF-8 Expires: Wed, 31 Dec 2025 23:17:48 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 31 Dec 2025 23:17:48 GMT Connection: close Strict-Transport-Security: max-age=15768000 ; includeSubDomains ; preload no healthy upstream
Open service 2a02:26f0:3100::1725:e268:443 · xpsstandalone-at-qa.allianz.de
2025-12-31 23:17
HTTP/1.1 503 Service Unavailable Content-Length: 19 Content-Type: text/plain; charset=UTF-8 Expires: Wed, 31 Dec 2025 23:17:49 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 31 Dec 2025 23:17:49 GMT Connection: close Strict-Transport-Security: max-age=15768000 ; includeSubDomains ; preload no healthy upstream
Open service 23.50.131.139:443 · xpsstandalone-at-qa.allianz.de
2025-12-22 18:08
HTTP/1.1 401 Unauthorized
x-content-type-options: nosniff
x-xss-protection: 0
x-frame-options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' http://localhost:* *.allianz *.allianz.at
Content-Encoding: gzip
Content-Type: application/json
Content-Length: 110
Expires: Mon, 22 Dec 2025 18:08:25 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 22 Dec 2025 18:08:25 GMT
Connection: close
Strict-Transport-Security: max-age=15768000 ; includeSubDomains ; preload
{"timestamp":"2025-12-22T18:08:25.508+00:00","status":401,"error":"Unauthorized","path":"/"}