Freedom251 › API Security Software
Checkmarx API Security
What Checkmarx API Security is
Checkmarx API Security finds APIs in application code and documentation, including shadow APIs without documentation and zombie APIs that are no longer in use. It creates a global inventory of detected APIs and vulnerabilities, with support for prioritizing remediation by business risk. The scanner supports Java Spring, ASP.NET Web API, and Python Flask. It can inspect OpenAPI, Swagger, and Postman collections, then compare those specifications with the inventory to surface discrepancies and undocumented APIs. Its API Change Log records API history and can identify the commit and developer associated with a change that introduced a vulnerability. Teams using Checkmarx DAST can correlate its findings with SAST results in the shared inventory, helping identify issues also confirmed during runtime testing. Checkmarx lists integrations with code repositories, build and development tools, issue trackers, and messaging services, including GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, GitHub Actions, VS Code, JetBrains, Jira, Slack, and Microsoft Teams. The product is available for API, web, and self-hosted environments. Pricing is custom quoted based on modules, deployment model, and developers in scope. There is no self-serve free trial; Checkmarx offers a personalized demo. Its product page says an AppSec expert responds to inquiries within one business day.
Who it suits
Checkmarx API Security suits application security teams that need to discover APIs in source code and documentation and prioritize vulnerabilities by business risk. It may also fit teams that want to compare API specifications with discovered APIs or correlate DAST and SAST findings.
What it does well
- Finds undocumented shadow APIs and abandoned zombie APIs.
- Compares OpenAPI, Swagger, and Postman collections with its API inventory.
- Tracks the commit and developer tied to vulnerability-introducing changes.
- Correlates Checkmarx DAST findings with SAST findings.
- Lists integrations with repositories, IDEs, issue trackers, and messaging tools.
What to know first
- There is no free plan or self-serve free trial.
- Pricing requires a custom quote.
- The scanner currently supports Java Spring, ASP.NET Web API, and Python Flask.
Limits
Essentials includes SAST, SCA, API Security, and ASPM, with additional modules available as add-ons. No free plan or self-serve trial is offered; pricing is custom quoted.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Checkmarx One bundle | Pricing is based on developers, apps, and usage. · Custom quote · Pricing based on developers, apps and usage | On request |
| Essentials | SAST · SCA · API Security · ASPM | On request |
| Professional | Essentials plus malicious package protection · repository health · DAST · container security | On request |
| Enterprise | Essentials and Professional plus IaC Security · secrets detection · Codebashing | On request |
| Start with SAST | SAST · optional API Security · IaC Security · secrets detection · Checkmarx Assist · Codebashing · AI Inventory | On request |
| Start with Supply Chain | SCA · malicious package protection · repository health · container security | On request |
As checkmarx.com lists them, read 20 Sept 2026. The maker's own page has the final word.
Getting started
- Visit the Checkmarx API Security website.
- Request a personalized demo; there is no self-serve free trial.
- Discuss a custom quote based on modules, deployment model, and developers in scope.
- Choose a deployment approach and connect supported source code or API documentation.
- Review discovered APIs and vulnerabilities in the inventory.
Verdict
Choose Checkmarx API Security if your team needs API discovery, documentation comparison, and vulnerability context in a shared inventory. Teams evaluating it should account for custom pricing and request a personalized demo, since there is no self-serve trial.
Questions
How much does Checkmarx API Security cost?
Pricing is custom quoted based on modules, deployment model, and number of developers in scope.
Is there a free plan or trial?
There is no free plan or self-serve free trial. Checkmarx offers a personalized demo.
Which frameworks does the API Security scanner support?
It currently supports Java Spring, ASP.NET Web API, and Python Flask.
Which API documentation formats can it scan?
It scans OpenAPI, Swagger, and Postman collections, and compares them with the API inventory.
What integrations are listed?
Integrations include GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, GitHub Actions, VS Code, JetBrains, Jira, Slack, and Microsoft Teams.
What do the named plans include?
Essentials includes SAST, SCA, API Security, and ASPM. Professional adds Malicious Package Protection, Repository Health, DAST, and Container Security; Enterprise also includes IaC Security, Secrets Detection, and Codebashing. Additional modules are available as add-ons.
Facts from Checkmarx API Security's own pages
- API change history
- The API change log records endpoint history, commits, developers, and prior API states to help trace how risk was introduced. · checkmarx.com, 21 Oct 2026
- API discovery
- Source-code scanning automatically discovers API endpoints, including undocumented shadow APIs and abandoned zombie APIs. · docs.checkmarx.com, 21 Oct 2026
- Audience
- Checkmarx describes Essentials as core application security for teams building their program, Professional as a scaling package, and Enterprise as coverage for organizations with demanding security requirements. · checkmarx.com, 3 Oct 2026
- Change history
- The API Change Log shows API history, including the commit and developer associated with a change that introduced a vulnerability. · checkmarx.com, 3 Oct 2026
- CI/CD and IDE plugins
- Documented plugins include GitHub Actions, Jenkins, TeamCity, Azure DevOps, Maven, VS Code, Visual Studio, JetBrains, and Eclipse. · docs.checkmarx.com, 21 Oct 2026
- CLI
- The standalone CLI mirrors REST API functionality for project management, scan control, and result display. · docs.checkmarx.com, 21 Oct 2026
- CLI operating systems
- Tested CLI environments include Windows 10/11 and Windows Server, Red Hat, Amazon Linux, Fedora, Ubuntu, CentOS, and macOS Sequoia. · docs.checkmarx.com, 21 Oct 2026
- Company facts
- LinkedIn lists Checkmarx as privately held, founded in 2006, headquartered in Paramus, New Jersey, with 501–1,000 employees. · linkedin.com, 21 Oct 2026
- Company legal name
- Crunchbase identifies the legal entity as Checkmarx Ltd. · crunchbase.com, 21 Oct 2026
- Compliance
- The trust center states ISO/IEC 27001:2022 certification, annual independent SOC 2 Type II audits, GDPR alignment, and NIST SSDF alignment. · checkmarx.com, 21 Oct 2026
- DAST correlation
- Native Checkmarx DAST integration combines static and dynamic findings in one API inventory and raises priority when runtime exploitation is confirmed. · checkmarx.com, 21 Oct 2026
- DAST limitation
- DAST runs from Checkmarx One have a two-hour-45-minute timeout and uploaded result archives are limited to 150 MB. · docs.checkmarx.com, 21 Oct 2026
- DAST requirements
- DAST CLI guidance specifies 8–16 GB RAM, 3 GB RAM and 2 CPUs per worker, and Docker-capable Windows, macOS, or Linux. · docs.checkmarx.com, 21 Oct 2026
- Deployment
- Checkmarx pricing documentation says Checkmarx One is available as SaaS or self-hosted/on-premises, including air-gapped deployments. · checkmarx.com, 21 Oct 2026
- Documentation scanning
- OpenAPI, Swagger, and Postman documentation can be scanned and compared with the discovered API inventory to expose discrepancies. · checkmarx.com, 21 Oct 2026
- Founded
- 2006 · checkmarx.com, 28 Sept 2026
- Global API inventory
- The product maintains an inventory of APIs and detected vulnerabilities so teams can prioritize remediation by business risk. · checkmarx.com, 21 Oct 2026
- Headquarters
- Ramat Gan, Israel · checkmarx.com, 28 Sept 2026
- Integrations
- Checkmarx lists 41 integrations spanning SCM, CI/CD, IDEs, ticketing, registries, cloud, and infrastructure tools. · checkmarx.com, 21 Oct 2026
- Inventory
- It provides a global API inventory with detected vulnerabilities and supports prioritizing remediation by business risk. · checkmarx.com, 3 Oct 2026
- License model
- The 2026 license terms define Checkmarx One licensing around contributing developers and a 15-million-lines-scanned-per-license 90-day account limit. · checkmarx.com, 21 Oct 2026
- Limit: Capterra reviewers
- Capterra reviewers mention false positives, slow scans, difficult configuration, limited user-friendliness, and unsupported languages such as ColdFusion and R. · capterra.com, 21 Oct 2026
- Limit: G2 false positives
- G2 summarizes recurring complaints about many false positives complicating analysis, plus individual complaints about slow scans, confusing setup, and high cost. · g2.com, 21 Oct 2026
- Limit: GetApp reviewers
- GetApp review data shows value-for-money scoring of 3.0/5 and complaints about expense, slowness, messy reporting, installation difficulty, and downtime delays. · getapp.com, 21 Oct 2026
Where Checkmarx API Security stands on Freedom251
- API Security Software#11 of 30