Akto as a Continuous API monitor

What middleBrick covers

Scheduled rescans every six hours to monthly for change detection
Detection of OWASP API Top 10 (2023) findings with risk scoring
OpenAPI 3.0/3.1 and Swagger 2.0 parsing with $ref resolution
Authenticated scans with header allowlist and domain verification
Read-only testing with protections against unsafe network targets
Programmatic access via API, CLI, GitHub Action, and MCP Server

Continuous monitoring versus on demand scanning

A continuous API monitor runs scheduled scans to surface changes between assessments, while an on demand tool is typically executed point in time. middleBrick offers scheduled rescans every six hours, daily, weekly, or monthly, and stores historical score data to track drift over time. This approach supports ongoing visibility rather than a one off snapshot, enabling teams to correlate findings with development activity and configuration changes.

Detection scope aligned to OWASP API Top 10

The scanner covers the OWASP API Top 10 (2023) through automated detection of authentication bypass, JWT misconfigurations, BOLA and IDOR, BFLA and privilege escalation paths, property over exposure, input validation issues such as CORS wildcard usage, rate limiting anomalies, and data exposure patterns including PII and API key formats. It also inspects encryption hygiene, SSRF indicators, inventory issues like missing versioning, unsafe consumption surfaces, and LLM security probes across multiple depth tiers. Findings are mapped directly to OWASP API Top 10 (2023) to help prioritize remediation.

OpenAPI specification analysis and runtime correlation

middleBrick parses OpenAPI 3.0, 3.1, and Swagger 2.0 documents with recursive $ref resolution, then cross references the spec against live behavior. This highlights undefined security schemes, sensitive fields exposed by the API, deprecated operations, and missing pagination controls. By comparing the declared contract with observed responses, the scanner identifies mismatches that often precede security defects, and surfaces findings relevant to audit evidence for controls described in SOC 2 Type II and PCI-DSS 4.0.

Authenticated scanning and safety controls

Authenticated scans support Bearer tokens, API keys, Basic authentication, and cookies. Domain verification via DNS TXT record or a well known HTTP file ensures only the domain owner can submit credentials. A strict header allowlist permits only Authorization, X-API-Key, Cookie, and X-Custom-* headers. The scanner uses read-only methods, blocks private IPs, localhost, and cloud metadata endpoints, and does not execute destructive payloads. Customer data can be deleted on demand and is purged within 30 days of cancellation.

Remediation guidance and integration options

The scanner does not fix or patch findings; it reports results with prioritized remediation guidance. Outputs are available via a web dashboard for managing scans and downloading branded compliance PDFs, a CLI with JSON and text output, a GitHub Action that can fail builds based on score thresholds, an MCP server for AI assisted workflows, and a programmable API for custom integrations. Continuous monitoring mode adds diff detection, email alerts rate limited to one per hour per API, and HMAC-SHA256 signed webhooks that auto disable after five consecutive failures.

Frequently Asked Questions

Can this tool replace a human pentester for high risk audits?

No. The scanner does not perform intrusive testing such as active SQL injection or command injection, and it does not detect business logic vulnerabilities that require domain understanding. It is a complement to, not a replacement for, human expert review.

Does the scanner detect blind SSRF or out of band data exfiltration?

No. Blind SSRF that relies on out of band infrastructure is out of scope. The scanner checks for URL and body fields that could be used for SSRF and performs active IP bypass probes, but it does not validate external network interactions.

How are compliance claims framed for regulations such as HIPAA or GDPR?

What happens to scan data after account cancellation?

Customer scan data is deletable on demand and is permanently purged within 30 days of cancellation. Data is never sold and is not used for model training.