Migrating from APIsec to Pynt

This guide outlines the practical steps to move from APIsec to middleBrick as your API security scanner. The focus is on data export, rebuilding scan history in the new platform, and preserving existing CI wiring. middleBrick is a self-service black-box scanner that returns a letter grade risk score with prioritized findings, so expectations and workflows will differ from tools that integrate deeper into your build pipeline.

Export findings from APIsec in a structured format such as JSON or CSV, including severity, endpoint, parameter, and remediation notes. In middleBrick, you do not import findings directly; instead you re-run scans against the same API definitions to generate comparable results. Use the CLI to automate repeated scans and capture JSON output for archival. Cross-reference exported APIsec identifiers with your middleBrick dashboard to manually map closed findings and track status changes over time.

middleBrick does not ingest historical scan data, so you will rebuild history by scheduling recurring scans and using the dashboard trend lines. Enable continuous monitoring on the Pro tier to get scheduled rescans at six-hour, daily, weekly, or monthly intervals. Use the diff capabilities to surface new findings, resolved findings, and score drift. Export periodic dashboard snapshots to maintain an external timeline that mirrors your previous reporting cadence.

Update your CI configuration to call the middleBrick CLI or API instead of APIsec commands. Example CLI usage: middlebrick scan https://api.example.com/openapi.json --format json. In GitHub Actions, replace existing steps with the middleBrick GitHub Action, setting your score threshold to fail the build. If you used webhooks in APIsec, replicate them with middleBrick’s HMAC-SHA256 signed webhooks, noting that they auto-disable after five consecutive failures and require host ownership verification via DNS TXT or a well-known file.

middleBrick does not fix, patch, block, or remediate findings; it detects and reports with remediation guidance. It does not perform active SQL injection or command injection testing, nor does it detect blind SSRF that requires out-of-band infrastructure. The scanner focuses on read-only methods and blocks destructive payloads, private IPs, localhost, and cloud metadata endpoints. Authentication in starter and above supports Bearer, API key, Basic auth, and cookies, with domain verification to ensure only the domain owner can scan with credentials. Adjust your workflows to account for these limitations and rely on the generated remediation notes and external pentest coverage for business logic or advanced exploit paths.