API Auto-Discovery: Instant endpoint detection & security scoring

What is API Auto-Discovery?

Auto-Discovery is Flasqo's intelligent endpoint detection system. Give it any URL — a website, API root, or even a single endpoint — and it automatically:

• 🔍 Discovers all API endpoints by crawling common paths and analyzing responses
• 📖 Detects OpenAPI/Swagger specs and extracts documented endpoints
• 🔐 Identifies authentication patterns (Bearer, API Key, OAuth, Basic Auth)
• 🛡️ Scores security headers (CORS, CSP, HSTS, X-Frame-Options)
• ⚡ Auto-generates tests for every discovered endpoint

Why Auto-Discovery matters

Manual API documentation is often outdated, incomplete, or missing entirely. Auto-Discovery solves this by:

• Finding undocumented endpoints: Developers forget to update docs, but Auto-Discovery finds them anyway
• Auditing third-party APIs: Before integrating, know exactly what endpoints exist
• Security assessment: Discover exposed admin endpoints, debug routes, or legacy APIs
• Instant test generation: No need to manually write test cases for each endpoint

How Auto-Discovery works

How to use Auto-Discovery in Flasqo

1. Navigate to Auto-Discovery
   Go to Testing Types → Auto-Discovery → Launch
2. Enter target URL
   Paste any URL:
   • https://api.example.com (API root)
   • https://example.com (website)
   • https://api.example.com/v2/users (specific endpoint)
   Flasqo adapts its discovery strategy based on what you provide
3. Click "Start Discovery"
   Flasqo runs in parallel:
   • Checks for OpenAPI/Swagger specs
   • Crawls common API paths
   • Analyzes responses for patterns
   • Tests security headers
4. Review discovered endpoints
   Results show:
   • Full endpoint list with HTTP methods
   • Auth requirements detected
   • Security score (0-100)
   • Response types (JSON, XML, HTML)
5. Security scoring breakdown
   Instant assessment:
   • ✅ HTTPS enabled
   • ✅ CORS configured (or ⚠️ missing)
   • ✅ Security headers present (CSP, HSTS, X-Frame-Options)
   • ⚠️ Warnings: Exposed debug routes, missing rate limiting
   • ❌ Failures: Unsecured HTTP endpoints, admin routes public
6. Auto-generate tests
   Click "Generate Tests" on any discovered endpoint
   Flasqo creates:
   • Functional tests for all HTTP methods
   • Security tests (auth bypass, injection)
   • Performance baseline tests
   Tests are instantly runnable — no manual writing
7. Export results
   Download as:
   • JSON: Import into CI/CD pipelines
   • OpenAPI spec: Generate documentation from discovered endpoints
   • PDF report: Share with team/stakeholders

Real-world use cases

Pre-integration API audit

"We're integrating with a third-party API. What endpoints do they actually have?"

→ Auto-Discovery finds all endpoints, including undocumented ones, before you commit to integration.

Legacy API documentation

"Our API has been evolving for 5 years. Docs are outdated. What's actually live?"

→ Auto-Discovery crawls production and generates accurate endpoint list + auto-generates fresh OpenAPI spec.

Security audit

"Are there any exposed admin or debug endpoints we forgot about?"

→ Auto-Discovery finds /admin, /debug, /__env, and scores security posture.

Competitive analysis

"How does their public API work?"

→ Paste competitor's API URL, discover public endpoints, analyze auth patterns and response schemas.

What Auto-Discovery detects

Endpoint discovery

• RESTful APIs (GET /users, POST /auth/login)
• GraphQL endpoints (/graphql, introspection)
• WebSocket endpoints (ws://, upgrade headers)
• Hidden admin routes (/admin/*, /internal/*)
• Health check endpoints (/health, /ping, /status)

Authentication detection

• Bearer token: Authorization: Bearer {token}
• API Key: X-API-Key, api_key query param
• OAuth 2.0: Detects auth flow endpoints
• Basic Auth: Authorization: Basic {base64}
• Custom headers: Identifies proprietary auth schemes

Security assessment

• HTTPS enforcement: HTTP → HTTPS redirect check
• CORS policy: Access-Control-Allow-Origin analysis
• Security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options
• Rate limiting: Detects X-RateLimit-* headers
• Exposed secrets: Checks responses for API keys, tokens in error messages

Auto-Discovery vs manual testing

Best practices

1. Run on staging first

Auto-Discovery makes real HTTP requests. Test on staging/dev environments before production to avoid triggering rate limits or alerts.

2. Review before testing

Discovered endpoints may include destructive operations (DELETE /users/:id). Review endpoint list before auto-running tests.

3. Combine with other test types

Auto-Discovery finds endpoints. Follow up with:

• Functional testing: Validate response schemas
• Security testing: Test auth bypass, injection
• Performance testing: Load test discovered endpoints

4. Schedule regular scans

Run Auto-Discovery weekly to catch new endpoints as your API evolves. Flasqo can alert you when new endpoints appear.