Vooki Pro treats a REST API as a project: a collection of HTTP requests you can edit, send and scan as a unit. APIs have no pages to crawl, so the requests themselves are the attack surface.

1. Create an API project

1. Open Applications and click New application.
2. Set the type to API.
3. Enter a name, pick an environment (dev, staging or prod) and optionally add a description. There is no base URL field, because each request carries its own URL.

The type is fixed once the project is created: a web target cannot become an API project, or the other way round.

2. Add requests

You rarely need to type requests by hand. Vooki Pro imports:

• OpenAPI / Swagger v2 and v3. Every path and operation becomes a request, with parameters and example bodies filled in.
• Postman collections, with folders, requests, headers and bodies.
• HAR files from your browser's network tab, another tool or a Vooki Pro recording. You can untick analytics and static-asset noise before importing.

You can also turn a browser recording straight into an API project with Build an API project. See Importing and exporting API projects.

3. Check the requests in the API Builder

Open API Builder from the sidebar. Your projects and requests are on the left. On the right are the request editor (method, URL, Headers, Body and Raw tabs) and the response viewer.

Click Send to fire a request and see the live response. Before scanning, confirm that each request works, with the right auth and the right body shape. Scanning a request that returns 401 tests nothing useful.

The API Builder only sends requests; it never scans them. Scanning is started separately, so you never fire attack payloads by accident.

4. Environments, variables and auth

• Define variables such as baseUrl and token once per environment. Switch environments and the whole collection follows, with no editing of each request. This also keeps secrets out of individual requests.
• Apply a saved auth profile to the whole collection in one action. Supported types are bearer token, basic auth, API key, cookie and OAuth2 client credentials.
• For tokens that expire, configure auto-login so the scan gets a fresh token at the start and refreshes it mid-scan.

5. Scan the project

1. Open Scans, click New Scan and choose the API flow.
2. Project: pick the API project.
3. Policy: choose which checks run, and how fast.
4. Review: click Launch scan, or Export Config to run the scan from the CLI.

Use the project's include and exclude rules to keep the scanner on endpoints you own, and exclude destructive endpoints such as bulk delete.

What gets tested

• OWASP API Top 10: broken object-level authorisation (BOLA), broken function-level authorisation (BFLA), broken object property-level authorisation, mass assignment, unrestricted resource consumption, SSRF, improper inventory and versioning, and unsafe consumption of APIs.
• JWT handling: alg=none, weak algorithms, algorithm confusion, jku / kid abuse, and tokens leaked in URLs.
• GraphQL: introspection exposure, injection and query-depth denial of service.
• OAuth, OIDC and SAML: state and PKCE handling, redirect URI validation, and SAML signature wrapping and replay.
• Injection, access control, deserialization and the rest of the shared check catalogue.

Full reference: REST API scanner (docs)