Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549a6e954f8ba07c0133bda15a95c74aa80949e7048
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
DELETE /api/outbreaks/UnpublishOutbreakFromNdb/{id}
DELETE /api/samples/UnpublishFromNdb/{id}
DELETE /api/samples/{identifier}/filelinks
GET /api/ADX_DRS
GET /api/adx/drs/samples/_findByIdentifier
GET /api/adx/drs/samples/today
GET /api/adx/drs/samples/{sampleId}
GET /api/adx/drs/samples/{sample}/analyses/{processType}
GET /api/comparisons
GET /api/comparisons/{id}
GET /api/comparisons/{id}/analyses
GET /api/comparisons/{id}/analyses/{analysisName}
GET /api/comparisons/{id}/distance_matrix_blob
GET /api/comparisons/{id}/upgma_tree
GET /api/events
GET /api/events/unpublishrequests
GET /api/events/{id}
GET /api/labs
GET /api/labs/{id}
GET /api/organisms
GET /api/organisms/{id}
GET /api/organisms/{organizationName}/{organismName}
GET /api/organizations
GET /api/organizations/organizationName/{organizationName}
GET /api/organizations/{id}
GET /api/outbreaks
GET /api/outbreaks/getbyidentifier/{identifier}
GET /api/outbreaks/ndb/identifier/{identifier}
GET /api/outbreaks/ndb/{id}
GET /api/outbreaks/{id}
GET /api/pipelineruns
GET /api/pipelineruns/{id}
GET /api/pipelineruns/{id}/output-file
GET /api/pipelineruns/{id}/weblog
GET /api/pipelines
GET /api/pipelines/{id}
GET /api/reanalysissamples/processReanalysis
GET /api/samples
GET /api/samples/getbyidentifier/{identifier}
GET /api/samples/getbylabaccessionnumber/{labAccessionNumber}
GET /api/samples/ndb/findclusters
GET /api/samples/ndb/identifier/{identifier}
GET /api/samples/ndb/{id}
GET /api/samples/ndb/{id}/analyses
GET /api/samples/outbreak/{outbreakId}/specimenkeys
GET /api/samples/samples/{id}/fileref/{name}
GET /api/samples/{id}
GET /api/samples/{id}/analyses2
GET /api/samples/{id}/analyses2/{processName}
GET /api/samples/{id}/match_profile
GET /api/samples/{id}/ncbi_processes
GET /api/samples/{id}/pipelinerun
GET /api/samples/{id}/processes
GET /api/samples/{sampleId}/analysesBy/{processName}
GET /api/users
GET /api/users/ProfileMatchingFilters
GET /api/users/getcurrentuser
GET /api/users/{id}
GET /api/views
GET /api/views/getshared
GET /api/views/{id}
POST /api/adx/drs/samples
POST /api/adx/drs/samples/_search
POST /api/adx/drs/samples/analyses/_bulk
POST /api/auth/amd_token
POST /api/auth/basespace_token
POST /api/auth/token
POST /api/comparisons/getcomparisonlist
POST /api/labs/{labId}/DendrogramExportTemplates
POST /api/labs/{labId}/MetadataImportTemplates
POST /api/labs/{labId}/PipelineTemplates
POST /api/outbreaks/bulkdelete
POST /api/outbreaks/bulkinsert
POST /api/outbreaks/publish_multipleoutbreaks_ndb
POST /api/outbreaks/search
POST /api/outbreaks/{id}/publish_ndb
POST /api/pipelineruns/{id}/cancel
POST /api/pipelineruns/{id}/restart
POST /api/pipelines/{pipelineId}/ExecutePipeline
POST /api/samples/api/sample/validate
POST /api/samples/bulkdelete
POST /api/samples/bulkinsert
POST /api/samples/confirm_multiplesamples_ndb
POST /api/samples/filelink/bulklinkfiles
POST /api/samples/getcompared
POST /api/samples/getsamplelist
POST /api/samples/match_profiles
POST /api/samples/publish_multiplesamples_ndb
POST /api/samples/query
POST /api/samples/query_ndb
POST /api/samples/querybyid
POST /api/samples/querybyid/analyses
POST /api/samples/querybyid/analyses/alignment
POST /api/samples/querybyid/analyses/allele_code_tree
POST /api/samples/querybyid/analyses/upgma_tree
POST /api/samples/querybyid/analyses/{analysisName}
POST /api/samples/querybyid_ndb
POST /api/samples/search
POST /api/samples/unconfirm_multiplesamples_ndb
POST /api/samples/{id}/publish_ndb
POST /api/users/{id}/FavoriteComparisons
POST /api/users/{id}/FavoriteViews
POST /api/views/getviewlist
PUT /api/comparisons/{id}/ml_tree
PUT /api/events/unpublishEvents
PUT /api/events/{id}/updateEvent
PUT /api/labs/{labId}/DendrogramExportTemplates/{name}
PUT /api/labs/{labId}/MetadataImportTemplates/{name}
PUT /api/labs/{labId}/PipelineTemplates/{name}
PUT /api/outbreaks/ndb/{id}/metadata
PUT /api/samples/ndb/{id}/metadata
PUT /api/samples/{id}/metadata
PUT /api/samples/{id}/traces
PUT /api/samples/{id}/updateIdentifier
PUT /api/users/ProfileMatchingFilters/{name}
PUT /api/users/{id}/FavoriteComparisons/{comparisonID}
PUT /api/users/{id}/FavoriteViews/{viewID}
Severity: info
Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
Public Swagger UI/API detected at path: /swagger/index.html
Open service 23.55.163.161:80 · angelriskmanagement.com
2026-01-26 11:36
HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://www.angelriskmanagement.com/ Expires: Mon, 26 Jan 2026 11:37:18 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 26 Jan 2026 11:37:18 GMT Connection: close
Open service 23.55.163.161:443 · angelriskmanagement.com
2026-01-26 11:36
HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://www.angelriskmanagement.com/ Expires: Mon, 26 Jan 2026 11:36:55 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 26 Jan 2026 11:36:55 GMT Connection: close Alt-Svc: h3=":443"; ma=93600
Open service 23.55.163.161:443 · brooklynunderwriting.com.au
2026-01-26 11:36
HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 ETag: W/"dce014475a8b021fdcec99bc0639dc49" Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=315360000; includeSubDomains; preload X-Allowed-Enabled: true X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Request-Id: 05b1b8c6-3d8c-4fcd-a023-2580d9b3a0e9 X-Runtime: 0.566997 X-Xss-Protection: 1; mode=block Expires: Mon, 26 Jan 2026 11:36:57 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 26 Jan 2026 11:36:57 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Set-Cookie: _pos_session=48b40399aa37359758d715d0dee782ea; path=/; expires=Mon, 09 Feb 2026 11:36:57 GMT; secure; HttpOnly; SameSite=Lax Alt-Svc: h3=":443"; ma=93600
Open service 23.55.163.161:80 · brooklynunderwriting.com.au
2026-01-26 11:36
HTTP/1.1 301 Moved Permanently Content-Type: text/html Content-Length: 134 Location: https://brooklynunderwriting.com.au:443/ Expires: Mon, 26 Jan 2026 11:37:19 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 26 Jan 2026 11:37:19 GMT Connection: close Page title: 301 Moved Permanently <html> <head><title>301 Moved Permanently</title></head> <body> <center><h1>301 Moved Permanently</h1></center> </body> </html>
Open service 23.55.163.161:80 · nudgeaxaxl.co.uk
2026-01-26 11:35
HTTP/1.1 301 Moved Permanently Content-Length: 0 Retry-After: 0 Location: https://nudgeaxaxl.co.uk/ Accept-Ranges: bytes X-Served-By: cache-fra-eddf8230177-FRA X-Cache-Hits: 0 X-Timer: S1769427365.878645,VS0,VE0 Strict-Transport-Security: max-age=300 Expires: Mon, 26 Jan 2026 11:36:04 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 26 Jan 2026 11:36:04 GMT Connection: close
Open service 23.55.163.161:443 · nudgeaxaxl.co.uk
2026-01-26 11:35
HTTP/1.1 301 Moved Permanently Content-Length: 162 Location: https://myapps.microsoft.com/signin/ddeae468-812d-4c6a-9694-3357ae55ee2c?tenantId=53b7cac7-14be-46d4-be43-f2ad9244d901 Content-Type: text/html Accept-Ranges: bytes X-Served-By: cache-fra-eddf8230071-FRA, cache-fra-eddf8230071-FRA X-Cache-Hits: 0, 0 X-Timer: S1769427342.283746,VS0,VE49 Strict-Transport-Security: max-age=300 Expires: Mon, 26 Jan 2026 11:35:42 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 26 Jan 2026 11:35:42 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 Page title: 301 Moved Permanently <html> <head><title>301 Moved Permanently</title></head> <body> <center><h1>301 Moved Permanently</h1></center> <hr><center>nginx</center> </body> </html>
Open service 23.55.163.161:443 · uat-pulsenet-api-usa.cdc.gov
2026-01-23 07:30
HTTP/1.1 404 Not Found Content-Length: 0 x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000 Request-Context: appId=cid-v1:deab1477-ff4e-4c02-ada3-01867650b6b5 Expires: Fri, 23 Jan 2026 07:30:56 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Fri, 23 Jan 2026 07:30:56 GMT Connection: close Strict-Transport-Security: max-age=31536000 ; includeSubDomains ; preload
Open service 23.55.163.161:443 · uat-pulsenet-api-usa.cdc.gov
2026-01-09 16:21
HTTP/1.1 404 Not Found Content-Length: 0 x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000 Request-Context: appId=cid-v1:deab1477-ff4e-4c02-ada3-01867650b6b5 Expires: Fri, 09 Jan 2026 16:21:44 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Fri, 09 Jan 2026 16:21:44 GMT Connection: close Strict-Transport-Security: max-age=31536000 ; includeSubDomains ; preload
Open service 23.55.163.161:443 · uat-pulsenet-api-usa.cdc.gov
2026-01-02 21:47
HTTP/1.1 404 Not Found Content-Length: 0 x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000 Request-Context: appId=cid-v1:deab1477-ff4e-4c02-ada3-01867650b6b5 Expires: Fri, 02 Jan 2026 21:47:33 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Fri, 02 Jan 2026 21:47:33 GMT Connection: close Strict-Transport-Security: max-age=31536000 ; includeSubDomains ; preload
Open service 23.55.163.161:443 · uat-pulsenet-api-usa.cdc.gov
2025-12-22 22:33
HTTP/1.1 404 Not Found Content-Length: 0 x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000 Request-Context: appId=cid-v1:deab1477-ff4e-4c02-ada3-01867650b6b5 Expires: Mon, 22 Dec 2025 22:33:06 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 22 Dec 2025 22:33:06 GMT Connection: close Strict-Transport-Security: max-age=31536000 ; includeSubDomains ; preload