AquilaX API Security Scanner

What AquilaX API Security Scanner is

AquilaX API Security Scanner analyzes API specifications and probes running endpoints to identify security weaknesses. Its checks address the OWASP API Security Top 10, including broken authentication, object-level authorization problems, mass assignment, excessive data exposure, and rate-limiting gaps. Supported inputs include OpenAPI 3.x and Swagger 2.0, GraphQL schemas, gRPC/Protobuf, Postman collections, discovered URLs, REST APIs, and webhook endpoints. The API scanner is available on Premium and Ultimate plans, though all plans include unlimited scans without per-scan fees or scan quotas. AquilaX lists more than 50 integrations, including GitHub, GitLab, Jira, Slack, and Azure DevOps, as well as connections to CI/CD systems and IDEs such as GitHub Actions, Jenkins, VS Code, and JetBrains IDEs. It supports web, API, extension, and self-hosted deployments; on-premises options include air-gapped environments. AquilaX says source code is analyzed in isolated temporary environments, and that data in transit and stored findings are encrypted. Premium starts at $19/mo; Ultimate is $99 per developer per month and includes a 14-day free trial.

Who it suits

The scanner may suit development and security teams that need to check APIs against common API security risks. Its self-hosted and air-gapped deployment options may be relevant to teams with those deployment needs.

Limits

The Free plan includes secrets scanning, PII detection, compliance auditing, unlimited scans, and CI/CD and IDE integration, but does not include the API Security scanner. Premium, the lowest plan that includes the API scanner, costs $19 a month per developer; no scan quotas or per-scan fees apply on any plan.

Getting started

1. Visit the AquilaX API Security Scanner website.
2. Choose Free, Premium, or Ultimate; the API scanner is available on Premium and Ultimate.
3. Use the web, extension, API, or a self-hosted deployment route.
4. Provide a supported API specification, collection, schema, or endpoint for scanning.
5. For on-premises setup, use Docker or Docker Compose on Ubuntu 22.04 LTS or RHEL 9; air-gapped environments are supported.

Verdict

AquilaX combines specification analysis with runtime probing and supports a broad range of API inputs. The API scanner is not part of the listed Free plan, so check plan availability before choosing it.