XTRIKE API SECURITY · PLATFORM 12
XTRIKE API DESK — Proof-Driven API Security
Launch API Scan
OpenAPI 3.1 & GraphQL Schema Drift Auditor

OpenAPI 3.1 Specification Ingestion & Shadow API Discovery

Stage A of the Proof Validation Pipeline: diffs signed OpenAPI 3.1 contracts against live router ASTs and gateway telemetry.

Open Validation Pipeline
PUT /api/v2/users/{id}API3:2023 · CWE-915
Schema Drift (Mass Assignment)

OpenAPI 3.1 `UserUpdateInput` omits `additionalProperties: false`; controller binds `is_admin` and `role` directly to ORM.

GET /api/v2/admin/users/{id}API3:2023 · CWE-312
Response Over-Exposure

Live HTTP 200 payload includes `password_hash` (bcrypt) which is not declared in OpenAPI `AdminUserDTO`.

GET /api/swagger-uiAPI9:2023 · CWE-200
Undocumented Shadow Route

Interactive Swagger UI exposed in production gateway without authentication (`API-008`).

POST /api/graphqlAPI8:2023 · CWE-200
Introspection Enabled

GraphQL `__schema` introspection query allowed in production (`API-003`).