API Exposure Diff

Discover public API surfaces on a domain — OpenAPI/Swagger documents, GraphQL endpoints, Swagger UI/Redoc pages, REST documentation pages — and, given a prior snapshot, produce a severity-scored diff of what changed.

What it checks

• Crawls the domain for API surface signals: OpenAPI/Swagger JSON and YAML documents, GraphQL endpoints, Swagger UI and Redoc pages, and linked REST documentation.
• Normalizes and fingerprints every discovered surface into a stable snapshot.
• When a prior snapshot is supplied as baseline, diffs the current snapshot against it and reports each meaningful change with a severity.

Pricing

This is a paid, pay-per-event Actor: $0.10 per completed run.

A scan-only run (no baseline supplied) charges one api-surface-scan event; a run with a baseline charges one api-surface-diff event instead. Exactly one event is charged per run, only after a real result exists (success or a useful partial). There is no charge for invalid input, a target blocked by the public-network policy, or a run that fails before a result is produced.

Input

• domain (required): a public domain or HTTPS origin to crawl, e.g. example.com.
• baseline (optional): the normalizedSnapshot-shaped snapshot object returned by a prior run of this Actor. When supplied, the run also produces a severity-scored diff against it.
• maxCrawlPages (optional, default 40): upper bound on pages/resources fetched while discovering API surfaces.

Example input — first scan:

{"domain": "example.com", "maxCrawlPages": 40}

Example input — diff against a prior snapshot:

{"domain": "example.com", "baseline": {"...": "the snapshot object from a prior run's result"}}

Output

The default dataset receives one result envelope per run; RUN_SUMMARY in the default key-value store records processing, delivery, billing, dependency, and budget totals.

Representative scan-only output (produced through the Actor's real service path):

{
  "status": "success",
  "target": {"type": "domain", "identifier": "example.com"},
  "result": {
    "domain": "example.com",
    "snapshot": {
      "schemaVersion": "api-surface-snapshot/1",
      "domain": "example.com",
      "surfaces": [],
      "snapshotFingerprint": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945"
    },
    "diff": null,
    "pagesFetched": 12,
    "partial": false
  }
}

Representative diff output, re-run with the snapshot above as baseline against an unchanged domain:

{
  "diff": {
    "schemaVersion": "api-surface-diff/1",
    "baselineSnapshotFingerprint": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
    "currentSnapshotFingerprint": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
    "entries": [],
    "summaryCounts": {}
  }
}

restricted means the target resolved to a non-public address and was rejected locally, with zero outbound requests and no charge. Failures are isolated per target.

Limitations

• Public HTTPS domains only; private, loopback, link-local, metadata, reserved, and CGNAT targets are rejected before any request is made.
• Discovery only — the Actor never calls or executes any discovered API operation.

Privacy and security

The target domain is crawled directly by this Actor after local public-network validation (no external analysis dependency). Results are stored in the customer's Apify run dataset and summary store. Do not place credentials in target domains.

Support

For a reproducible support request, provide the Apify run ID, result itemId, and status. Contact Sentinel Signal Systems through the support link on the Actor page.