Skip to main content

MuleSoft Anypoint Exchange

This document is for Invicti Platform

This feature is available with Invicti API Security Standalone or Bundle.

Integrating Invicti Platform with MuleSoft Anypoint Exchange allows you to fetch Swagger2, OpenAPI3, and RAML specification files from MuleSoft to build an inventory of API endpoints that can be scanned for vulnerabilities with DAST scanners. The integration leverages Connected Apps, where Invicti is the app that integrates via user account with MuleSoft Anypoint Exchange.

This document explains how to set up an integration between MuleSoft Anypoint Exchange and Invicti Platform.

tip
  • Only Swagger2, OpenAPI3, and RAML specification files are imported.
  • RAML specifications are converted to OpenAPI2.x after import, and therefore show up as OpenAPI in the list.

Step 1: Ensure you have a MuleSoft Anypoint Exchange account​

To enable Invicti to successfully fetch your Swagger2, OpenAPI3, and RAML specification files from MuleSoft, you need to have a MuleSoft Anypoint Exchange account that contains your API specification files. This account is used to facilitate creating a Connected App integration between Invicti and MuleSoft Anypoint Exchange, which imports and syncs your API specifications.

The integration uses the Connected App to access the following filter scopes:

  • Exchange Viewer
  • Profile
  • Background Access (this is necessary for the refresh token functionality)

Once you have a MuleSoft Anypoint Exchange account, continue with step 2 below.

Step 2: Configure the API import source in Invicti​

Now that you have access to MuleSoft Anypoint Exchange, you are ready to set up the MuleSoft integration in Invicti to import your API specification files.

  1. Select Discovery > Configuration from the left-side menu. Then navigate to API sources.
  2. Click Add source.
  3. Enter a name for the API integration and select MuleSoft as the source type.
Select Mulesoft as the API source
  1. Click Authenticate and Save. You are directed to your MuleSoft account to authorize the integration, after which you are returned to Invicti.
  2. Log in to MuleSoft Anypoint Exchange with the account that contains your API specification files. Then click Grant access to… to authorize the integration.
Grant acces to authorise the integration

Once complete, you see a short message displayed in Invicti: Authorization was successful. Your MuleSoft integration now appears on the Sources page in Invicti. Continue with the final step below to synchronize the API import.

Step 3: Synchronize the API import​

  1. On the Discovery > Configuration > API sources page, click the sync icon to start importing your API specification files from MuleSoft into your Invicti API Inventory.
Click sync API sources to synchronize
  1. When the sync is complete, your API specification files are displayed on the API catalog. From this page, you can link your API specification files to targets so they can be scanned for vulnerabilities. For more information, refer to Linking and unlinking discovered APIs to targets.

Your MuleSoft Anypoint Exchange account is now integrated with Invicti Platform. After the initial synchronization, the integration automatically syncs your API specifications once every 24 hours.

tip

To synchronize API specifications on demand, click the sync icon on the Discovery > Configuration > Sources page. To turn off automatic synchronization, click the toggle in the Sync Automatically column.

Need help?​

Invicti Support team is ready to provide you with technical help. Go to Help Center

Was this page useful?