{"repo":"praetorian-inc/vespasian","free":true,"listed":false,"github":"https://github.com/praetorian-inc/vespasian","clone":"git clone https://github.com/praetorian-inc/vespasian.git","description":"API discovery tool that maps attack surfaces from captured traffic and generates specs for REST, GraphQL, SOAP, and WebSocket APIs","language":"Go","stars":123,"topics":["api-security","openapi","penetration-testing","api-enumeration","security-tools","api-discovery","attack-surface","burp-suite","headless-browser","openapi-generator"],"license":"Apache-2.0","category":"security-tools","readme_excerpt":"Discover API endpoints from real HTTP traffic. Generate OpenAPI, GraphQL SDL, and WSDL specs automatically. --- Vespasian: API Discovery and Specification Generation Tool Vespasian discovers API endpoints by observing real HTTP traffic and generates API specification files from those observations. It captures traffic through headless browser crawling or imports it from existing sources (Burp Suite XML exports, HAR files, and mitmproxy dumps), then classifies requests, probes discovered endpoints, and outputs specifications in the native format for each API type: OpenAPI 3.0 for REST, GraphQL SDL for GraphQL, and WSDL for SOAP services. Built for penetration testers and security engineers who need to map the API attack surface of web applications, single-page apps, and microservices when the API documentation is not available. Why Vespasian? Modern applications make API calls dynamically. Single-page applications construct requests at runtime via JavaScript. Mobile apps call APIs through native HTTP clients. Real-time features communicate over WebSocket connections. Static analysis and source code review miss these runtime behaviors entirely. Existing approaches to API discovery have limitations: - Checking known paths ( /swagger.json , /openapi.yaml ) only finds APIs that are explicitly documented - Static analysis cannot observe requests that are constructed dynamically at runtime - Manual proxy capture is time-consuming and produces raw traffic without structured specificat","default_branch":null,"files":null,"tree":[],"storefront":"/r/praetorian-inc","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/praetorian-inc/vespasian/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}