The API discovery tool that maps what your spec forgot.
Endpoints ship faster than anyone updates the spec. API eNVy™ reads supported source locally and emits an OpenAPI spec in under 20 seconds.
You can't secure APIs you don't know exist.
Endpoints ship from every corner of the business; the ones never onboarded stay invisible while the dashboard stays green. Source discovery closes that gap and feeds the routes into whole-app DAST.
| Source-based NightVision API eNVy™ | Traffic-based observability tools | Spec-driven scanners | |
|---|---|---|---|
| Finds undocumented & shadow APIs | ✅ Yes, from code | ⚠️ Only after traffic | ❌ Only what the spec lists |
| Works before code ships (in CI) | ✅ Pre-production | ❌ Needs production traffic | ⚠️ Only if the spec is current |
| Needs a running app or traffic | ✅ No | ❌ Yes | ✅ No |
| Needs an existing OpenAPI spec | ✅ No, it generates one | ✅ No | ❌ Yes |
| Time to generated inventory | ✅ Seconds on supported codebases | ❌ Depends on traffic | ⚠️ Depends on maintenance |
| Source & data exposure | ✅ Stays local; no LLM in spec generation | ❌ Traffic (tokens, PII) flows through the tool | ✅ Not applicable |
From repo to tested API surface in three steps.
1. Point at your code
Connect a repo or run the CLI against your source tree. No running app, no agents, no code changes.
2. Get the spec in <20 seconds
On supported codebases, API eNVy™ statically analyzes recognized routes, parameters, response shapes, and the authentication scheme protecting each endpoint, then writes an OpenAPI/Swagger spec.
3. Add routes to DAST
The generated spec feeds dynamic testing, with HTTP evidence on request-level findings and Code Traceback on supported ones.
REST API discovery across supported backend frameworks.
Support is claimed per framework, not per language, and every framework below is empirically verified.
Beyond routes: each endpoint is tagged public or protected and mapped to its security scheme (bearer, basic, API key, or OAuth2), with required roles on Java frameworks.
Source discovery covers REST APIs; other styles need a supported spec or recorded traffic. See the full support matrix in the docs.
Deterministic, local, and private by design.
Spec generation is pure static analysis: no LLM reads your code, and no cloud service ingests your traffic.
Your code never leaves your environment
The engine runs locally, as a CLI or inside CI; only lightweight metadata (an endpoint's existence, file, and line) is used.
Deterministic, not probabilistic
Like a compiler: supported constructs produce repeatable output every run.
No running app, no traffic, no agents
Point it at a supported repository and generate an OpenAPI inventory in seconds.
Source context where supported
On supported source-discovered API scans, Code Traceback connects a dynamic finding to the defining file and line.
Comparing API security testing tools? See NightVision vs Bright Security and NightVision vs Escape, or browse all DAST comparisons.
API discovery tool questions, answered.
What is API discovery?
The process of finding and inventorying API endpoints in your applications, including undocumented, shadow, and legacy routes missing from maintained OpenAPI specs, so dynamic testing gets a broader target inventory.
How does NightVision generate an OpenAPI spec from source code?
API eNVy™ statically analyzes supported source to identify recognized routes, parameters, response shapes, and the authentication scheme protecting each endpoint, then emits an OpenAPI (Swagger) spec in under 20 seconds, with no running app, traffic capture, or code changes.
What languages and frameworks does API eNVy™ support?
Python (Django/DRF, Flask, FastAPI), Java (Spring Boot, JAX-RS, Micronaut, Jakarta EE), JavaScript and TypeScript (Express, NestJS, Fastify), C# (ASP.NET Core), Ruby (Rails, Grape), and Go (Gin, Echo, chi, Fiber, gorilla/mux, net/http, httprouter). See the framework matrix in the docs.
Does API eNVy™ detect authentication and security schemes?
Yes. On supported frameworks, API eNVy™ reads each framework's native authentication patterns (guards, middleware, filters, and security annotations) and records them in the generated spec: every endpoint is marked public or protected, tagged with the scheme that guards it (bearer, basic, API key, or OAuth2), and Java endpoints also carry the roles they require. That tells DAST exactly where to authenticate and which exposed routes to hit first. See the framework support and limitations in the docs.
Does NightVision upload my source code?
No. API eNVy™ runs locally as a CLI or in your CI pipeline, and spec generation is deterministic static analysis with no LLM reading your code. Only lightweight metadata (an endpoint's existence, file path, and line number) is used.
Your spec is 20 seconds away.
Run API eNVy™ against one of your repos, free, no credit card, and count the endpoints you didn't know you had.