Skip to content

Start a New Scan

Create a Scan Profile

  1. Navigate to your scan profiles list and click New Scan Profile.

  2. Select your asset type: WebApp, REST API or GraphQL API.

  3. Enter your application or API URL.

    For REST APIs, the scanner prepends this URL to every schema path. If paths already include /api or /v1, use the origin without that prefix, such as https://api.example.com. A duplicated prefix becomes /api/api/... and returns NOT FOUND.

  4. Enter your credentials. You can configure authentication later in the profile settings if needed.

  5. For REST or GraphQL APIs, select existing schemas or upload them:

    • GraphQL: GraphQL introspection JSON or SDL (.graphql or .gql).
    • REST: Swagger v2, OpenAPI v3, WP-JSON, Postman Collection, Insomnia Collection, Burp Suite Export or HAR files.

    For HAR imports containing multiple hosts, Escape uses the host with the most requests and reports that choice in the validation events.

  6. Review Fine-Tune (Optional). See the options below.

  7. Enter a name and choose a project under Profile Details.

  8. Confirm the Prerequisites: Escape can reach the application through an IP allowlist or Sec-Escape-User header, or a Private Location. Accounts must have CAPTCHA and MFA disabled, or use a supported CAPTCHA or MFA flow.

Use Test Configuration to validate the setup. Choose Create Profile to save it, or Start Scan to save it and start scanning.

Fine-Tune Options

  • Location: Choose an Escape location or a Private Location.
  • Duration: Max duration defaults to 4 hours, with a range of 1 to 10 hours. Rate limit starts at 500 requests per second, with a slider range of 10 to 500. This limit applies to API requests, not browser navigation.
  • Scheduling: A weekly schedule is pre-filled. Remove it if you don't want recurring scans.
  • Safety Rules: The checkbox is unticked by default (read-write mode). For APIs, Read-only mode limits testing to read operations. For WebApps, the checkbox is labeled Crawling-only mode, but captured API read operations can still be tested. Browser navigation and form submissions can still change application state. See Production-Safe Scanning.

Common Pitfalls

My Endpoint Is Not a Valid Endpoint

If we can't validate your API endpoint but you believe it's correct, please contact us for assistance.

Coverage Is Full of NOT FOUND on Paths That Exist in the Spec

The scanner joins the REST asset URL and each spec path with a slash. If both already carry the same prefix (https://api.example.com/v1 + /v1/users → https://api.example.com/v1/v1/users), every request misses the real route.

Check the profile's validation events for Possible duplicated API base path or Possible API base path mismatch. The mismatch warning means the asset URL mount and the shared spec prefix may not align. Use the origin when spec paths include the mount, or use paths relative to the mount when the asset URL includes it. Set the asset URL to the origin (or the unique mount that's not already in the spec), or drop the duplicated prefix from the spec paths.

Your Endpoint Requires Authentication

Tests may fail if your endpoint requires authentication, whether through:

  • A firewall protecting the server
  • Application-layer authentication for endpoint fingerprinting

In these cases, provide authorization headers that will be included with all HTTP requests.