feat(workflows): add api_discover workflow and api scan

secator/config.py

@@ -168,6 +168,8 @@ class Wordlists(StrictModel):
 		'combined_subdomains': 'https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/combined_subdomains.txt',  # noqa: E501
 		'directory_list_small': 'https://gist.githubusercontent.com/sl4v/c087e36164e74233514b/raw/c51a811c70bbdd87f4725521420cc30e7232b36d/directory-list-2.3-small.txt',  # noqa: E501
 		'burp-parameter-names': 'https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Discovery/Web-Content/burp-parameter-names.txt',  # noqa: E501
+		# Assetnote's HTTP Archive API routes dataset (same data kiterunner's -A apiroutes uses), regenerated monthly
+		'apiroutes': 'https://wordlists-cdn.assetnote.io/data/automated/httparchive_apiroutes_2026_06_27.txt',  # noqa: E501
 	}
 	lists: Dict[str, List[str]] = {}
 

secator/configs/scans/api.yaml

@@ -0,0 +1,24 @@
+type: scan
+name: api
+description: API security scan
+long_description: |
+  End-to-end security assessment of a web API.
+  Discovers API endpoints (api_discover), then fuzzes their parameters (url_params_fuzz) and scans the
+  discovered surface for common web vulnerabilities and exposed secrets (url_vuln). Composes existing
+  workflows rather than duplicating their logic, so each stage stays independently reusable.
+profile: default
+tags: [http, api, fuzz, vuln, secrets]
+input_types:
+  - url
+workflows:
+  api_discover:
+  url_params_fuzz:
+    targets_:
+    - type: url
+      field: url
+      condition: url.verified
+  url_vuln:
+    targets_:
+    - type: url
+      field: url
+      condition: url.verified

secator/configs/workflows/api_discover.yaml

@@ -0,0 +1,58 @@
+type: workflow
+name: api_discover
+alias: apid
+description: API endpoint discovery
+long_description: |
+  Discovers API endpoints on a target web application.
+  Combines active crawling (katana, which parses JavaScript to surface referenced endpoints) with optional
+  brute-forcing of API routes (ffuf, using Assetnote's HTTP Archive apiroutes wordlist — the same real-world
+  route dataset kiterunner relied on). Discovered endpoints are probed with httpx to verify they are live and
+  fingerprint their technologies. The apiroutes wordlist also covers exposed API specification paths
+  (openapi/swagger), so they surface when fuzzing is enabled. Endpoint discovery only — parameter fuzzing,
+  vulnerability scanning and secrets hunting are handled by the url_params_fuzz and url_vuln workflows (see
+  the `api` scan).
+tags: [http, api, crawl, fuzz]
+input_types:
+  - url
+
+default_options:
+  follow_redirect: true
+
+options:
+  waf:
+    is_flag: True
+    help: Fingerprint WAF (wafw00f)
+    default: False
+
+  fuzz:
+    is_flag: True
+    help: Brute-force API routes with the apiroutes wordlist (ffuf)
+    default: False
+    short: fuzz
+
+tasks:
+  katana:
+    description: Crawl for API endpoints
+
+  ffuf:
+    description: Brute-force API routes
+    wordlist: apiroutes
+    auto_calibration: true
+    if: opts.fuzz
+    targets_:
+      - type: target
+        field: '{name}/FUZZ'
+
+  wafw00f:
+    description: Fingerprint WAF
+    if: opts.waf
+
+  httpx:
+    description: Probe discovered API endpoints
+    tech_detect: True
+    filter_duplicates: True
+    targets_:
+      - target.name
+      - type: url
+        field: url
+        condition: not url.verified

tests/integration/inputs.py

@@ -38,6 +38,7 @@
 }
 
 INPUTS_WORKFLOWS = {
+	'api_discover': 'localhost:3000',
 	'cidr_recon': '127.0.0.1/30',
 	'code_scan': str(ROOT_FOLDER),
 	# 'dir_finder': 'localhost:3000',  # TODO: add fixture with directories
@@ -57,6 +58,7 @@
 }
 
 INPUTS_SCANS = {
+	'api': ['http://localhost:3000'],
 	'domain': 'testphp.vulnweb.com',
 	'host': ['localhost'],
 	'network': '127.0.0.1/24',

tests/integration/outputs.py

@@ -176,6 +176,9 @@
 }
 
 OUTPUTS_WORKFLOWS = {
+	'api_discover': [
+		Url(url='http://localhost:3000', method='GET', _type='url'),
+	],
 	'cidr_recon': [Ip(ip='127.0.0.1', host='', alive=True, _source='fping', _type='ip', _uuid='ea92f674-4cfe-4556-91f5-8669644513a0')],
 	'code_scan': [
 		Vulnerability(
@@ -584,4 +587,5 @@
 	],
 	'network': [],
 	'url': [],
+	'api': [],
 }