Skip to main content
availability

Package: Invicti AppSec Core (on-demand)

IBM API Connect

Invicti AppSec Core can connect to IBM API Connect SaaS to automatically import published API specifications into your API catalog, so they're ready to be scanned for vulnerabilities.

This document explains how to set up the integration between Invicti AppSec Core and IBM API Connect.

Why this matters​

Manually uploading API specifications is time-consuming and error-prone when your API landscape changes frequently. Connecting Invicti AppSec Core directly to IBM API Connect keeps your API catalog up to date automatically, so every published API is available for scanning without requiring manual intervention each time a new API is added or updated.

Prerequisites​

To set up this integration, you need an IBM API Connect SaaS account. Before you begin, have the following values ready from your IBM API Connect instance:

  • Platform API endpoint - the base URL for the IBM API Connect platform API (for example, https://platform-api.trial.apiconnect.automation.ibm.com)
  • Client ID - the platform API client ID
  • Client secret - the platform API client secret
  • API key - the platform REST API key

Refer to the IBM API Connect documentation for how to obtain these values.

tip

Only Swagger2 and OpenAPI3 specification files are imported.

Step 1: Configure the API source in Invicti AppSec Core​

The configuration is a two-step wizard: source details followed by connection details.

Source details​

  1. Select Discovery > API sources from the left-side menu.
  2. Click Add source.
  3. Enter a name for the source configuration to help you identify it later in your list of API sources.
  4. Under Exclude empty specifications, select Yes to skip APIs that don't have defined operations, or No to import all APIs regardless.
  5. Under Source type, select IBM API Connect from the API gateway section.
  6. Click Continue.

Connection details​

  1. Enter the Platform API endpoint - the base URL for the IBM API Connect platform API (for example, https://platform-api.trial.apiconnect.automation.ibm.com).
  2. Enter the Client ID from IBM API Connect.
  3. Enter the Client secret from IBM API Connect.
  4. Enter the API key - the platform REST API key from IBM API Connect.
  5. Click Save profile.

Your IBM API Connect integration is now listed on the Discovery > API sources page.

Step 2: Synchronize​

To run an immediate sync, click the sync icon next to the source on the Discovery > API sources page. Imported specifications appear in your API catalog and can be linked to targets for DAST scanning.

Invicti AppSec Core automatically synchronizes with IBM API Connect every 24 hours. You can trigger a manual sync or turn off auto-sync using the toggle on the source.

Troubleshooting​

The sync completes but no APIs appear in my API catalog

Check that the credentials you entered have read access to the published API definitions in IBM API Connect. You can also check the last error message on the Discovery > API sources page - the error details shown there can help identify what went wrong on the connection or import side.

Authentication fails when saving the source configuration

Verify that the Platform API endpoint, Client ID, Client secret, and API key all match the values from your IBM API Connect instance exactly. If the issue persists, regenerate the credentials in IBM API Connect and update the source configuration in Invicti AppSec Core.

Need help?​

Invicti Support team is ready to provide you with technical help. Go to Help Center

Was this page useful?