Skip to main content

Takumi Blackbox Assessment Now Supports UI-less APIs

· One min read
Tsubasa Umeuchi
Tsubasa Umeuchi
Software Engineer @ GMO Flatt Security Inc.

In Takumi blackbox assessments, APIs that have no web UI can now be specified as an assessment target.

Instead of crawling with a web browser, Takumi extracts the endpoints to assess from the attached schema files, such as an OpenAPI specification or a GraphQL schema.

Configuration UI

Overview​

Blackbox assessments have relied on crawling a web browser to discover the endpoints to assess. This works well for applications operated through a browser, but not for APIs that serve no screen — there is nothing to crawl, so they could not be assessed. Many real-world targets, however, are API-only, such as backends for mobile apps and service-to-service APIs.

With this release, Takumi can assess those UI-less APIs directly. When you select API as the target type, Takumi does not crawl; it extracts the endpoints from the attached schema files instead.

Getting Started​

This feature is available to all organizations from the blackbox assessment dispatch screen.

For how to configure the schema files and authentication steps, see Assessing an API.