Discover what actually shipped
API Tap sits on the loopback path between your edge and the app. The first time an endpoint takes traffic, it appears in the catalog — no code change, no nginx rewrite.
WEB/Apps and APIs
Web applications and APIs, tested as they change
This is the Web package: continuous DAST against the running application and its APIs. A new route is a hypothesis. The finding keeps the requests, the responses, and the impact.
Find vulnerabilities. Prove their impact.
One investigation
Hypothesis, test, evidence
01
Name it
“This endpoint might skip an authorization check.” The path is the thing to test.
02
Run it live
Request the same resource as the owner and as a second account. Keep both responses.
03
Attach the proof
A match is the impact. The next deploy can show whether it is still there.
Source is the other half of the same workspace. When the repository is connected — local, GitHub, or GitLab — the code that handles the request sits next to the live test. See how investigation runs →
Find vulnerabilities. Prove their impact.
Connect the application. The workspace keeps testing it as the routes change.
API Tap
Do you have an API catalog?
When developers take a new endpoint live, who knows? Who is watching? Spreadsheets and last year’s OpenAPI go stale the moment someone merges. Trusteed API Tap watches real traffic, catalogs every unique API, and puts what shipped on the test queue.
Do you have an API catalog?
Or a wiki and an OpenAPI file that were true last quarter.
Who knew about Friday’s /v2/export?
A developer shipped it. Security finds out from a customer — or an attacker.
Who is watching new endpoints?
CI can gate the repo. It cannot see the route that never made the spec.
Is that API even tested?
If it is not in the catalog, it is not in the scan queue.
One living catalog
Each unique method, host, and path template is recorded once. /users/42 and /users/99 are the same API. Query strings do not create duplicates.
Test the new ones
Catalog records become HAR for the Trusteed API scanner. Change-triggered tests run on what is live, and only high-impact findings reach your SOC.
EdgeCloudflare, nginx, ALBTLS terminates. Apps stay unchanged.
→API TapPassive loopback listenOne redacted sample per unique endpoint.
→TrusteedCatalog + scannerHAR in. Change-triggered tests out.
Works where your APIs already run
Cloud, edge, and reverse-proxy native
Sit behind Cloudflare, AWS, Azure, GCP, Nginx, Apache, and the gateways teams already operate. No application injection. A Linux agent with network capture is enough.
Cloudflare
AWS
Azure
Google Cloud
Nginx
Apache
Kong
Fastly
Envoy
Traefik
Evidence
What we can prove about Web
The Web package tests a running application and its APIs. This page does not publish a shadow-API average.
- Web
- Apps and APIs
- Evidence
- Requests and responses on the finding
01Web investigation is not a runtime firewall and not a signed pentest PDF.
ResultThe package tests the live application and documents impact. A firewall in front of traffic, and a human pentest attestation, stay separate when you still need them.
MethodProduct boundary of the Web package on this page.
Scope · September 2026Running web applications and APIs. Not bot or DDoS mitigation at the edge.
Buying questions
What does the Web package test?
Web is continuous DAST for applications and APIs. A new route starts a hypothesis. The finding keeps the requests, the responses, and the impact.
01Who is the Web package for?
Source sits beside it when the repository is connected. The code explains the path. The live test shows the impact.
ExampleGET /api/orders/{id} as two accounts. Matching bodies become the proof of broken access control.
02What stays continuous?
The Web package is the standing test of the running target, not a one-time report.
03When is this the wrong buy?
A firewall and a human pentest stay separate when you still need them.
Not a fitWrong buy for a team with no web application or API to test.