Checkmarx API Security

Checkmarx API Security is the API-specific scanner inside the Checkmarx One Code pillar. Where DAST exercises the application end-to-end, API Security focuses on the API contract: the endpoints exposed, the auth model on each, the schema validation, the rate limits, and the runtime drift between what the OpenAPI document says and what the runtime actually serves. Programs running pure DAST against the web frontend are missing the structural risk; the API surface is usually the actual application.

Shadow API discovery is the load-bearing capability. In real environments, the API surface drifts: developers ship endpoints, deprecate them informally, fork an internal version, or expose a debugging route that becomes load-bearing. Checkmarx API Security crawls the runtime, reconciles against the OpenAPI or GraphQL schema in source control, and surfaces the delta. Endpoints that exist in production but are missing from documentation are shadow APIs; endpoints in documentation that no longer exist are zombie APIs. Both create risk that pure SAST and DAST never catch.

Runtime risk scoring per endpoint is the prioritization signal. Not every API endpoint carries the same risk: a public unauthenticated read endpoint is low-risk; an internal write endpoint with authorization-only access to a financial record is high-risk. Checkmarx scores per endpoint based on auth shape, data sensitivity, traffic patterns, and historical findings. The AppSec team triages high-risk endpoints first instead of treating an OpenAPI document as a flat list.

What disrupts API Security adoption is incomplete schema. The product reconciles against documented OpenAPI, GraphQL, or gRPC contracts, and programs without authoritative schemas in source control end up with the scanner inferring everything from runtime traffic alone. That works but loses the drift-detection advantage. Merito's engagement starts with schema discipline: are the OpenAPI specs authoritative, are they current, and are they checked into the same repo as the implementation. Without that, API Security degrades to runtime scanning, which is still useful but not the full product.

Merito has audited AppSec programs that ran rigorous DAST against the web frontend and zero scanning against the API surface, then discovered breach exposure on shadow API endpoints nobody knew existed. The web app is the visible part of the application; the API is the structural part. Programs running DAST without API Security are scanning what is easy to scan and missing what an attacker actually exploits.

Merito recommends Checkmarx API Security specifically when the API surface has more than a few dozen endpoints, when schema discipline (OpenAPI in source control) is real or in reach, and when consolidation onto Checkmarx One pays back the integration cost. For programs without authoritative schemas, the runtime discovery still works but loses the drift-detection advantage. Merito surfaces that during scoping rather than overstating what the product delivers without inputs.

Specialist API security vendors (Salt Security, Noname) are competitive on runtime detection and behavioral analytics. Checkmarx API Security differentiates on schema-first integration and cross-product correlation with SAST, SCA, and DAST inside one backlog. Programs picking Checkmarx are picking platform consolidation; programs picking Salt or Noname are picking specialist depth. Both decisions are valid.