APIKit
Discover and scan APIs with APIKit, a Burp Suite plugin that parses API documentation for security testing.
About APIKit
APIKit is an open-source plugin for Burp Suite that discovers exposed API documentation and converts it into Burp Suite requests for security testing. It passively checks traffic passing through Burp Suite and also provides active scans, including targeted scans by API technology, base path, documentation path and headers.
Version 1.0 detects GraphQL, OpenAPI-Swagger, Springboot Actuator, SOAP-WSDL and REST-WADL. Cookie retention and automated requesting are disabled by default, and automated requests are intended only for legally authorized testing of permitted targets.
Key features
- Passively detects API documentation in traffic passing through Burp Suite
- Converts discovered API documentation into Burp Suite requests for testing
- Runs active API fingerprint scan from any Burp Suite request
- Runs targeted scan by API type, base path, doc path and headers
- Optionally retains cookies when generating API requests
- Optionally sends automated requests to check for unauthorized API access
Best for: Security testers using Burp Suite to assess APIs from exposed documentation during authorized tests.
Good for
- Open-source Burp Suite plugin under GPL-3.0 license
- Supports five API types including GraphQL, OpenAPI-Swagger and SOAP-WSDL
- Shows results in APIKit panel and Burp Dashboard and works with tools like xray
Watch out for
- Version 1.0 covers five API technologies, with more coverage still planned
- Request sending and cookie handling are disabled by default and require configuration
- Use is limited to legally authorized testing with sufficient authorization
APIKit at a glance
- Category
- Development › APIs & Databases
- Type
- Open-source project
- Pricing
- Not confirmed. Check the site
- Open source
- Yes · Source code
- Language
- English
- Last checked
- Oct 6, 2026 · Online when checked
- Listed
- Oct 5, 2026
Guides for APIs & Databases
APIKit alternatives
Tools and sites you could use instead, ranked by how closely they match.
This API extracts and parses text from PDF, Word, and PowerPoint files, with OCR models and options to anonymize documents and remove PII.
Open source
24 alternatives
Access structured data and links about anime, manga, movies, and other entertainment through Cooren APIs.
Open source
24 alternatives
Expose Discord presence and activity through REST and WebSocket APIs with Lanyard.
Open source
24 alternatives
Access Android system APIs from regular applications through this Shizuku fork using adb or root privileges.
Open source
24 alternatives
Use Android system APIs from regular apps through Shizuku, which runs a Java process started with app_process.
Open source
24 alternatives
Create Telegram bots using the Telegram Bot API HTTP server in this repository.
Open source
24 alternativesPopular in APIs & Databases
Well-known listings from the same topic.
API3api3.orgTwiliotwilio.comDB Browsersqlitebrowser.orgPocketBasepocketbase.ioBrunousebruno.comMeilisearchmeilisearch.com
APIKit FAQ
How is APIKit installed?
In Burp Suite, open Extender, select Extensions, and add the APIKit.jar file.
Which API technologies does version 1.0 detect?
GraphQL, OpenAPI-Swagger, Springboot Actuator, SOAP-WSDL and REST-WADL.
How does a targeted scan work?
Use Do Target API scan, enter the API technology, BasePath ending with /, documentation path and headers, then select Scan.
Is something wrong or out of date?
Tell us and an editor will check it.
Own this website?
Claim this listing
Claim the listing and suggest updates yourself. An editor checks every claim first.