# Supported Targets

Escape discovers and tests the targets below. Discovery support and testing depth vary by product.

## APIs

- **REST**: OpenAPI 3.x, Swagger 2, Postman collections, or endpoints extracted from crawling and recorded HAR/Burp exports. See [REST API DAST](</documentation/dast/api-testing/>).
- **GraphQL**: SDL or introspection-based discovery, queries, mutations, and subscriptions. See [GraphQL API DAST](</documentation/dast/api-testing/graphql/>).
- **gRPC**: discovered and classified by ASM service discovery.
- **SOAP**: discovered and classified by ASM service discovery. Deep DAST testing is available for REST, GraphQL, and web applications.

## Web Applications

- **Single-page apps (SPA)**: React, Vue, Angular, Svelte, and similar; agentic crawling + browser-driven DAST.
- **Server-rendered apps**: Rails, Django, Spring, Next.js (SSR), and similar.
- **Progressive web apps (PWA)**: browser-accessible pages and APIs.

See [WebApp DAST](</documentation/dast/webapp-testing/>).

## AI and LLM Surfaces

- **LLM-backed APIs**: chat completions, RAG endpoints, function-calling surfaces. OWASP LLM Top 10 coverage. See [LLM Security](</documentation/dast/llm-security/>).
- **AI applications**: agentic apps that wrap an LLM with tools and state.
- **MCP servers**: Model Context Protocol servers exposed over HTTP.

## Infrastructure and Discovery

- **Domains and subdomains**: owned DNS, inferred from certificates and routing, and monitored for drift.
- **CIDR ranges**: IPv4 ranges of /24 or narrower, either public or private through a Private Location. See [Network Scanning](</documentation/asm/network-scanning/>) for wider-range requirements.
- **Ports and services**: TCP port scanning with service fingerprinting. See [Network Scanning](</documentation/asm/network-scanning/>).
- **Cloud accounts**: AWS, GCP, Azure inventory through the [ASM Integrations](</documentation/asm/integrations/>).

## Client and Infrastructure Scope

- **Mobile applications (iOS, Android)**: Escape tests their APIs. Testing mobile binaries and mobile SAST are outside this scope.
- **Native desktop applications**: Escape tests their backend services. Testing the desktop client is outside this scope.
- **Kernel and firmware testing**: outside Escape's application and API testing scope.

If your stack isn't listed and you think it should be, write to [support@escape.tech](<mailto:support@escape.tech>).