APIGuard

APIGuard is the API security testing platform in the opensecstack ecosystem. Point it at any OpenAPI, Swagger, or GraphQL schema, and it runs a full OWASP API Top 10 security assessment against your live API endpoints, producing CVSS 3.1-scored findings in HTML, PDF, JSON, or SARIF format.

Overview

APIGuard is licensed under Apache-2.0 and is built for both local developer use and CI/CD pipeline automation. It ships as a single Go binary and a React dashboard backed by PostgreSQL. No telemetry, no SaaS requirement.

The platform covers all ten OWASP API Security Top 10 (2023) categories — from Broken Object Level Authorization (A1) to Unsafe Consumption of APIs (A10) — and maps every finding to NIS2 Article 21 security measures for compliance evidence.

Key features

• Full OWASP API Top 10 coverage — all ten categories (A1–A10) implemented and enabled by default (A6 and A10 require additional configuration).
• Multi-format schema support — parses OpenAPI 3.x, Swagger 2.x, and GraphQL schemas via a Rust-based parser that never panics on malformed input.
• CVSS 3.1 scoring — every finding receives a deterministic CVSS 3.1 score computed by a dedicated Rust scorer.
• Multiple output formats — HTML and PDF for human review (Python + Jinja2), JSON and SARIF for machine consumption and GitHub Advanced Security upload.
• Flexible authentication — supports Bearer token, JWT, OAuth2 (client_credentials / authorization_code), API key, and HTTP Basic auth for the target API.
• CI/CD integration — ships a GitHub Action (opensecstack/apiguard-action@v1) and supports GitLab CI and Jenkins natively.
• Scan history dashboard — React UI on port 3000 shows scan trends, finding regressions, and API inventory.
• NIS2 Directive mapping — findings are mapped to NIS2 Article 21 measures to produce compliance evidence artefacts.

Architecture

APIGuard is a ten-layer pipeline. Each layer has a single responsibility and a defined input/output contract — no layer knows the internals of another, making every layer independently testable and replaceable.

Rust handles all untrusted input and high-throughput analysis: the schema parser (L1), test generator (L2), response analyser (L5), and CVSS scorer (L6). Memory safety eliminates buffer-overflow vulnerabilities when processing schemas from arbitrary sources. Go handles concurrent HTTP execution (L3), auth token lifecycle management (L4), report generation for machine formats (L7), persistence (L8), and the CLI (L10). The React dashboard (L9) is SELECT-only against PostgreSQL via row-level security.

Ports & endpoints

The full REST API reference is at http://localhost:8080/api/v1/docs when the server is running. See docs/api.md for the complete endpoint catalogue.

Integration

sinauth (identity)

APIGuard delegates all user authentication to sinauth via OpenID Connect (authorization code + PKCE). ID and access tokens are RS256-signed and validated against the sinauth JWKS endpoint (https://auth.sin.to/.well-known/jwks.json). The web dashboard uses sinauth.ts for popup-based login and an AuthCallback page. A POST /api/v1/auth/logout endpoint maintains an access-token denylist for explicit revocation.

CITADEL (governance)

APIGuard emits scan lifecycle events — scan_started, scan_completed, finding_critical, and finding_high — to the CITADEL WORM audit chain via a one-way outbound webhook. CITADEL cannot write back to APIGuard scan data. Configure with CITADEL_WEBHOOK_URL and CITADEL_API_KEY.

IRFlow (incident response)

APIGuard sends HMAC-SHA256 signed webhook events to IRFlow when critical or high findings are detected, allowing IRFlow to automatically open or update security incidents. IRFlow listens on POST /api/v1/webhooks/apiguard with replay protection (±5 min window).

ThreatFlow (threat intelligence)

APIGuard sends scan target URLs and discovered API endpoints to ThreatFlow for IOC matching. ThreatFlow in turn enriches APIGuard scans with known-malicious URL and IP indicators from its STIX 2.1 bundle store.

NIS2 Compass (compliance)

APIGuard findings are mapped to NIS2 Article 21 security measures. See docs/nis2-mapping.md for the full compliance evidence mapping.

Quick start

"cm"># Run a scan locally
apiguard scan \
  --spec ./api/openapi.yaml \
  --target http://localhost:8080 \
  --format html \
  --output report.html

"cm"># Or use the GitHub Action
- uses: opensecstack/apiguard-action@v1
  with:
    spec: ./api/openapi.yaml
    target: ${{ secrets.API_TARGET_URL }}
    fail-on: HIGH
    format: sarif
    output: apiguard-results.sarif

Full documentation

The complete APIGuard documentation lives in the apiguard/docs folder on GitHub. Key references:

• quick-start.md — from zero to first scan in 5 minutes
• architecture.md — layered pipeline design and component responsibilities
• api.md — full REST API reference
• configuration.md — all CLI flags, environment variables, and config file options
• owasp-coverage.md — detection methods, confidence levels, known false positives
• cicd-integration.md — GitHub Actions, GitLab CI, and Jenkins examples