dast_api

Last updated: Oct 27, 2026

dast_api is Fluid Attacks' native binary for API security testing. It reads the endpoints from a Postman collection, sends requests and changed versions of them to your API, and reports the vulnerabilities that it finds. Different from the Docker-based scanners, dast_api is a single self-contained binary that runs without Docker. It authenticates each run and does not scan without a credential.

Installation

Linux and macOS

Run the one-line installer:

curl -fsSL https://public.fluidattacks.com/dast_api/install.sh | sh

This installs the dast_api binary to /usr/local/bin by default.

Verify the installation

dast_api --version

Scan with a configuration file

dast_api scans from a YAML configuration file that you give with --config:

dast_api scan --config dast-api-config.yaml

Each entry in dast.api must have the base_url of the API and one or more Postman collections in api_specs:

dast:
  api:
    - base_url: https://api.example.com
      api_specs:
        - postman/collection.json

An entry without api_specs stops the scan with an error. Thus, the scanner does not report a target that it did not test.

Authenticate

dast_api does not scan without a credential. The platform attributes each run to the person or system that ran it.

dast_api requires authentication. Without a credential the scan does not run and exits with code 1.

If you run dast_api on your own machine, you do not have to use a Group token. Run dast_api login one time to sign in through your browser. You do not have to keep a secret.

In other conditions, authenticate with the Group token of your group, in one of these ways:

Long-lived secret: set the INTEGRATES_API_TOKEN environment variable to a Group token. Get it from Organization → Groups → GroupName → DevSecOps → Manage token in the platform.
Short-lived, from OIDC: this method is for systems that can issue OpenID Connect tokens (CI/CD, AWS, GCP, Kubernetes, and more). Use --group <your-group>, and dast_api gets a token for each run with no stored secret. On GitHub Actions, dast_api gets the token automatically. On other systems, give the token as the INTEGRATES_OIDC_TOKEN environment variable.

If INTEGRATES_API_TOKEN is set, the scanner uses it and ignores OIDC and the browser login. If a CI OIDC source is present, you must use --group, and the scanner does not use a browser login.

For the full guide, read Authentication. It includes the OIDC federation setup.

The scanner uses the token only to identify the caller. It does not show the token or write it to logs.

Common scenarios

Send credentials to the API under test

The credentials that the scanner sends to your API are different from your Fluid Attacks group token. key is the header name and value is only the secret. The bearer, oauth1 and oauth2 types add their own prefix. Thus, do not include a prefix. You can read the value from an environment variable:

dast:
  api:
    - base_url: https://api.example.com
      api_specs:
        - postman/collection.json
      authentication:
        - type: bearer
          key: Authorization
          value: ${API_TOKEN}

The accepted types are bearer, apikey, oauth1 and oauth2.

Scan several APIs

dast:
  api:
    - base_url: https://api.example.com
      api_specs:
        - postman/public-api.json
        - postman/admin-api.json
    - base_url: https://payments.example.com
      api_specs:
        - postman/payments.json

Block the pipeline on findings

To block a pipeline with strict mode, read Distributed binaries. dast_api accepts it only in the configuration file.

Troubleshooting

For common installation troubleshooting (permission denied, PATH issues), read Distributed binaries.

No output file is produced

Without output.file_path, the scanner writes the report to FluidAttacksDastApiResults in the directory where you ran the scan. The file has the extension of the configured format (.sarif by default). Look for it there before you change the configuration. ALL writes two reports, .csv and .sarif. output.format must be SARIF, CSV or ALL. Other values cause an error.

Environment variable referenced in the scan config is not set

If the full value of a credential is ${API_TOKEN}, you must export that variable before the scan. If you do not, the scanner stops and does not send an empty credential. If the placeholder is part of a longer text, the scanner replaces it with an empty string and the scan continues.

dast_api

On this page