Internal microservice audit

Run the Internal microservice audit check

What middleBrick covers

  • Black-box scanning with no agents or SDK dependencies
  • Authentication support for bearer, API key, basic, and cookie
  • Detection of OWASP API Top 10 and authentication misconfigurations
  • LLM adversarial probes across Quick, Standard, and Deep scan tiers
  • OpenAPI 3.0/3.1 and Swagger 2.0 parsing with $ref resolution
  • Continuous monitoring with signed webhooks and alert rate limiting

What is an internal microservice audit

An internal microservice audit assesses how services authenticate, authorize, and expose operations to one another inside your network. The focus is on runtime behavior of endpoints, authentication mechanisms, and data exposure paths rather than source code review. This type of audit maps findings to OWASP API Top 10 controls and helps you prepare for SOC 2 Type II and PCI-DSS 4.0 requirements by validating security configurations against defined policies.

What teams get wrong when they skip this audit

Without an internal audit, teams rely on assumptions about network segmentation and access controls. Common gaps include overly permissive service-to-service tokens, missing rate limiting on administrative endpoints, and excessive data returned from internal calls. These issues can enable lateral movement, IDOR, and sensitive data leakage across microservice boundaries, and they often surface only after an incident.

A practical audit workflow

Start with service discovery to enumerate reachable endpoints, then run authentication and authorization checks against each service. Follow with input validation and data exposure tests, focusing on internal field leakage and over-exposed properties. Record findings with request and response samples, and prioritize by risk score. A repeatable workflow includes scheduled rescans and diff detection to track new findings and resolved findings across time.

GET /admin/users HTTP/1.1
Host: internal.api.example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9

What middleBrick covers out of the box

middleBrick is a self-service API security scanner that runs black-box checks against any reachable service. It supports authenticated scanning with Bearer, API key, Basic auth, and cookies, and enforces domain verification so only the domain owner can scan with credentials. The scanner detects authentication bypass, BOLA and BFLA, property authorization over-exposure, input validation issues, rate limiting behavior, data exposure patterns including PII and API keys, encryption misconfigurations, SSRF indicators, and unsafe consumption surfaces. For LLM-facing endpoints, it runs 18 adversarial probes across Quick, Standard, and Deep tiers to test for system prompt extraction, instruction override, and data exfiltration risks.

Integration and compliance framing

middleBrick integrates into dashboards, CI/CD pipelines, and alerting workflows without requiring code changes or SDKs. The web dashboard provides scan results, score trends, and downloadable compliance PDFs. The CLI supports JSON and text output for scripting, and the GitHub Action fails the build when the score drops below your chosen threshold. Continuous monitoring can run on six-hour, daily, weekly, or monthly schedules and provides HMAC-SHA256 signed webhooks with auto-disable after repeated failures. This tool supports audit evidence for security controls and aligns with security controls described in PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10 (2023).

Run this check on your API See all use cases

Frequently Asked Questions

Can middleBrick scan internal services that are not publicly accessible?
Yes, as long as the scanner can reach the endpoint over the network and domain verification passes. Use a host that resolves within your environment and ensure the domain verification file or DNS TXT record is in place.
Does the scanner test for SQL injection or command injection?
No. The scanner focuses on API-specific issues and does not send intrusive payloads such as SQL injection or command injection, which are outside its scope.
How are new findings tracked compared to previous scans?
Pro tier rescans compare results across runs and surface diff detection, showing new findings, resolved findings, and score drift. Alerts can be sent via email and signed webhooks to integrate with existing incident response processes.
Is my scan data stored or used to train models?
No. Customer scan data is deletable on demand and purged within 30 days of cancellation. It is never sold and never used for model training.
What authentication methods are supported for authenticated scans?
Bearer tokens, API keys, Basic authentication, and cookies. Only the specified Authorization, X-API-Key, Cookie, and X-Custom-* headers are forwarded to target services.