Importing and exporting: OpenAPI, Postman, HAR and scans

This article covers getting API requests, recordings and whole scans in and out of Vooki Pro.

Import API requests

When you create or open an API project, you can import from:

Source	What comes across
OpenAPI / Swagger (v2 and v3)	Every path and operation becomes a request, with parameters and example bodies filled in.
Postman collection	Folders, requests, headers and bodies.
HAR file	Captured browser or proxy traffic. The import dialog lets you untick analytics beacons and static assets first.

Import a Postman collection

In Postman, open the collection's menu and choose Export (Collection v2.1).
In Vooki Pro, open the API project and choose the Postman import.
Select the exported .json file.
Open a few requests in the API Builder and click Send to confirm they still work.

Postman environment variables

Vooki Pro projects have their own environments and variables. Recreate your Postman variables such as baseUrl and token in the project's environment, then switch environments to move the whole collection between dev, staging and prod. Keep secrets in variables, not in individual requests.

Recordings: HAR in and out

Import HAR on the Recordings screen turns traffic captured anywhere else into a Vooki Pro recording. You are asked which application it belongs to.
Export on any recording writes a .har file that other tools, or another Vooki Pro install, can import.
Build an API project on a recording turns its captured XHR and fetch calls into a scannable API project.

Scan configs for the CLI

On the final Review step of any web or API scan, click Export Config. This saves the whole setup (target, scope, auth, discovery, policy, throttling) as a JSON file that vooki-pro-cli can run. See CLI and CI/CD.

Whole scans: .vpscan archives

A report is a document. A .vpscan archive is the scan itself: every finding, the HTTP request and response behind it, the evidence markers and your triage states.

Export: open a scan and choose the .vpscan option from its Export menu.
Import: use Scans → Import on the same or another machine. The scan opens as if you had run it yourself, ready for triage and retest.
From a pipeline: set "export_scan_data": true in the CLI config. Set export_scan_data_redact_credentials to true if you publish it as a build artefact.

Back up everything

Everything Vooki Pro stores (applications, scans, findings, reports and the audit log) lives in ~/.vooki-pro/. Back up that folder to back up your full scan history.

Coming from the old Vooki app?

Old Vooki REST projects and environment-variable exports are not a Vooki Pro format. Re-import the original source (Postman collection, OpenAPI spec or HAR capture) into a new API project.

Related: REST API scanning