Migrating from APIsec to Snyk

This guide outlines how to move from APIsec to middleBrick when changing API security tooling. It focuses on data export, rebuilding scan history in middleBrick, and preserving CI wiring. The tone is neutral; middleBrick is a scanning service and does not replace the need for human review or an auditor.

Begin by exporting findings and configuration from APIsec in a structured format such as JSON or SARIF. If APIsec provides a project or scan ID, use its API or UI to retrieve historical results. Map exported issue types to middleBrick categories, noting which findings map to authentication, authorization, input validation, data exposure, and LLM security. Because middleBrick is a black-box scanner, you cannot import raw scan payloads directly; instead, use the exported data to rerun equivalent checks in middleBrick and to repopulate tracking dashboards.

In middleBrick, start by submitting the same API endpoints and parameters used in APIsec scans. Use the dashboard to create projects and organize APIs by environment or service. For authenticated scans, provide Bearer tokens, API keys, or Basic credentials through the allowed header list, ensuring domain verification passes via DNS TXT or HTTP well-known file. middleBrick stores scan results as risk scores and categorized findings; export these periodically and compare them with your APIsec exports to validate coverage and identify gaps. Note that scan history is rebuilt through repeated scans rather than direct import of prior results.

Update your CI/CD pipelines to call the middleBrick CLI or API where you previously invoked APIsec. For example, replace existing scripts with middlebrick scan <url>, using JSON output for machine parsing. In GitHub Actions, switch from the APIsec action to the middleBrick GitHub Action and adjust threshold settings so that the build fails on equivalent risk scores. If you used webhooks in APIsec, replicate them with middleBrick’s HMAC-SHA256 signed webhooks, and configure retry and alert behavior. Pro tier continuous monitoring can provide scheduled rescans and diff detection to surface new findings or score drift.

Some capabilities from APIsec may not have direct equivalents in middleBrick. middleBrick does not perform active SQL injection or command injection testing, does not detect business logic vulnerabilities, and does not replace a human pentester for high-stakes audits. It also does not detect blind SSRF or provide fixes; it reports findings with remediation guidance. If your APIsec workflow relied on these specific tests, plan for manual follow-up or complementary tools. Additionally, scan history cannot be imported as a dataset; you must rerun scans to rebuild comparable data.