Freemium User FAQ

Helping you fix Your APIs today and prevent API breaches tomorrow

API Security Audit is a 42Crunch static API testing service that helps users find and fix issues with their OpenAPI contracts during the design time and avoid releasing unprotected APIs.

The API Security Audit performs over 300+ checks on the OpenAPI Contract checking for adherence to the OpenAPI specification, data definition quality (how well your schema is defined) and potential security vulnerabilities.

API Audit is available from a number of IDE marketplaces (via the openAPI Editor) and CI/CD platforms (as a plugin).  It is available either for free with limited usage or on the 42Crunch platform as a paid subscription.

There is an option to run the audit from the 42Crunch OpenAPI editor in VS Code, IntelliJ and Eclipse. 

First you need to activate the service. Here is a short video to explain.

Once the Audit service is active you can take a look at a tutorial video on how to run the API Security Audit.

There is an option to run the audit for freemium users from GitHub Actions. We will be expanding to Azure DevOps and other CI/CD platforms in the coming months. 

Please take a look at a tutorial video on how to run the API Security Audit & API Scan for freemium users from GitHub.

API Scan is a dynamic API Security Testing tool for REST API. This means that API Scan sends real API traffic to your API and examines and validates the responses.

The tests are automatically created by using the APIs' OpenAPI Definition file (OpenAPI Contract) to test the following:

1. Does the API conform to the API Design i.e. does it do what it is supposed  to do according to the design
2. Does it perform as it is supposed to - does it only allow the expected traffic and reject not expected traffic.
3. Are there any security weakness based on how the API is implemented.

Here is an explainer video

API Scan is available in IDEs (via the openAPI Editor) and the GitHub Actions CI/CD.  It is available for free with limited usage and non commercial basis (see Freemium FAQ section above).

You can also run API Scan on the 42Crunch platform. This is available only to paid subscribers.

There is an option to run the API Scan for freemium users from the IDEs We will be expanding to IntelliJ and Eclipse in the coming months. 

We are currently working on the tutorial video on this and will share shortly.

There is an option to run the API Scan for freemium users from GitHub Actions. We will be expanding to Azure DevOps and other CI/CD platforms in the coming months. 

Please take a look at a tutorial video on how to run the API Security Audit & API Scan for freemium users from GitHub.

API Security Testing with 42Crunch combines a number of our tools and integrates in the development lifecycle of the API as follows:

1. API Design - we help developers create and edit OpenAPI files using our Free OpenAPI editor tool in their favorite IDEs
2. API Audit - checks the API Design file for different structure, semantic and security flaws, marks the API Design file out of a score of 100 and also offers remediation advice and quick ways to fix the issues identified. This way you can quickly fix and create a robust OpenAPI contract. (more info above)
3. API Scan - checks the actual API for security flaws by sending dynamic traffic to it. The tests we do are based on the API design file of the same API. More Above

Now we also add in some additional things like data dictionaries to help standardize definitions used across all APIs, security quality gates that can prevent changes to APIs going into production without first having passed an approved score in both the API Audit and API Scan checks and finally we give all of this visibility to security teams which enables security teams and development teams work together with agreed security policies in a faster and more secure development process.

There are multiple benefits to upgrading to a paid subscription (see section below) but if you are unsure then please request an introductory call with one of our pre-sales engineers who an run discuss your requirements with you.

We have put together this video to help you use our API Security Testing Tools from GitHub Actions as a Free User