Checkmarx API Security is the API-specific scanner inside the Checkmarx One Code pillar. Where DAST exercises the application end-to-end, API Security focuses on the API contract: the endpoints exposed, the auth model on each, the schema validation, the rate limits, and the runtime drift between what the OpenAPI document says and what the runtime actually serves. Programs running pure DAST against the web frontend are missing the structural risk; the API surface is usually the actual application.
Shadow API discovery is the load-bearing capability. In real environments, the API surface drifts: developers ship endpoints, deprecate them informally, fork an internal version, or expose a debugging route that becomes load-bearing. Checkmarx API Security crawls the runtime, reconciles against the OpenAPI or GraphQL schema in source control, and surfaces the delta. Endpoints that exist in production but are missing from documentation are shadow APIs; endpoints in documentation that no longer exist are zombie APIs. Both create risk that pure SAST and DAST never catch.
Runtime risk scoring per endpoint is the prioritization signal. Not every API endpoint carries the same risk: a public unauthenticated read endpoint is low-risk; an internal write endpoint with authorization-only access to a financial record is high-risk. Checkmarx scores per endpoint based on auth shape, data sensitivity, traffic patterns, and historical findings. The AppSec team triages high-risk endpoints first instead of treating an OpenAPI document as a flat list.
Incomplete schemas are the usual obstacle. The product reconciles against documented OpenAPI, GraphQL, or gRPC contracts, and programs without authoritative schemas in source control leave the scanner inferring everything from runtime traffic alone. That works but loses the drift-detection advantage. An API Security rollout therefore starts with schema discipline. Are the OpenAPI specs authoritative, are they current, and are they checked into the same repo as the implementation? Without that, API Security degrades to runtime scanning, which is still useful but not the full product.
Ideal use cases
- Shadow API and zombie API discovery across runtime versus documented surface
- Runtime risk scoring on portfolios with hundreds or thousands of endpoints
- Drift detection between OpenAPI specs in source control and the runtime API
- One Checkmarx One queue for API, SAST, SCA and DAST findings instead of a separate API governance tool
- Regulated API governance for PCI DSS, HIPAA, and SOC 2 audits