Review agent · Platform & AI
API design & data exposure
Reviews findings from API documentation (Postman, OpenAPI, HAR) for data exposure and risky design.
Illustrative example of how this agent reviews a finding.
Why this agent matters
API suite analysis works from documentation and captured examples, not source code. A documented response that returns a password hash or a full card number is a real risk if the live API behaves as documented.
Scanners that read code can't see these. This agent judges the documented request and response, with values already masked, and says plainly what the docs can and cannot prove.
What it checks
- Secrets, card data or personal data in URLs
- Passwords, hashes, OTPs or full card numbers in responses
- List endpoints with no pagination
- Missing auth where sibling endpoints require it
- Mass-assignable fields such as role or balance in request bodies
- Verbose errors and sequential ids
When it marks a finding as a likely false positive
- Example or test data that is obviously fake
- A field that is already masked or tokenised, or a 'token' that is a pagination cursor
- A public, intentionally unauthenticated endpoint such as health, docs or login
- Personal data returned only to its owner on a profile endpoint
The fix it suggests
- Move secrets out of URLs into headers or the body
- Remove credentials from response models and mask account values in the serializer
- Add limit and cursor pagination with a server-side maximum
- Bind request bodies to an explicit allow-list DTO; return generic errors
Scope and limits
This agent judges findings the scanners report (Semgrep for code, secrets and IaC/config, OWASP ZAP for passive website scans, our rules for imported API collections); it doesn't hunt for new bugs on its own. A finding reaches it when its scanner, CWE or rule/path keywords match this vulnerability class. It sees only the minimal code or evidence around the finding, with secrets redacted, and Claude, via Amazon Bedrock, returns a verdict with a confidence score, a plain-English explanation and a suggested fix.
Common questions
Does it send traffic to my API?
No. It reviews the imported documentation and examples only. Nothing is ever sent to your API.
Can it prove an ID-guessing (IDOR) bug?
No. Docs can't show whether an ownership check exists, so it says so and recommends a per-object authorization check plus a test that another user's id is refused.
What does the API design agent mark as a false positive?
Obviously fake example or test data, fields that are already masked or tokenised, a 'token' that is really a pagination cursor, public endpoints such as health, docs or login, and personal data returned only to its owner on a profile endpoint.
Which API documentation formats does it review?
Findings come from imported Postman collections, OpenAPI 3 or Swagger 2 specs, HAR captures, and Insomnia or Bruno exports, with values masked before the agent sees them.
Related agents
- AI / LLM safety — Checks LLM application code for prompt injection and unsafe handling of model output.
- Network & transport security — Checks that data in transit is encrypted and certificates are actually verified.
- Privilege & file permissions — Checks file permissions, temp files, symlinks and unnecessary root.
See all 21 review agents → · Agent setup reviewer · How the pipeline works
Run the API design & data exposure agent on your repository
100 free credits, no credit card. Every finding comes with a verdict and a fix.
Get started free