Automatic API Schema Generation

Escape's capability to automatically generate API schemas extends to robust management features, including the detection of API versions and schema changes. This functionality is crucial for maintaining accurate and up-to-date API documentation, facilitating better governance, and ensuring consistency across different environments.

Overview of Schema Generation

Escape reconstructs API schemas by parsing the abstract syntax tree (AST) of both frontend and backend source code. This allows for an accurate reconstruction of the API's structure, endpoints, and expected parameters, especially beneficial for REST APIs with OpenAPI specifications.

Features of Automatic Schema Generation

Frontend and Backend Code Analysis: Escape analyzes both frontend interactions and backend code (when available through Git integrations) to generate comprehensive API schemas. This dual-source approach ensures that the generated schemas are reflective of both the client-side and server-side realities of the API.
AST Parsing: The process involves parsing the AST from the code to dynamically generate detailed and accurate API schemas. This is particularly useful for organizations that may not have formalized API documentation.
Version Detection and Schema Change Tracking: Escape not only generates API schemas but also continuously monitors for and detects any changes or versions in the API schema over time. This capability allows teams to track how their APIs evolve and ensure that all changes are documented and understood, reducing the risk of inconsistencies or integration issues.

Integration with Git

Leveraging Git integrations enhances Escape’s schema generation capabilities by providing access to backend code, which is essential for APIs that do not have a frontend representation. This access is vital for creating a complete view of an API that may be under development or only partially exposed to the frontend.

Application in DAST

Once generated, these schemas are seamlessly integrated into the DAST process. Users can initiate dynamic application security testing with a simple click, employing the latest schema versions to ensure thorough and accurate testing coverage.

Handling GraphQL APIs

For GraphQL APIs, where the schema is inherently defined and exposed by the nature of the technology, Escape ensures that the schema is always current and reflects the latest API structure. This is crucial for maintaining the effectiveness of security and compliance checks.

Conclusion

Automatic API schema generation by Escape is a powerful tool for developers and security teams alike. By providing capabilities like version detection and schema change tracking, Escape not only simplifies API management but also enhances security and compliance through continuous and automated documentation. This proactive approach to API schema management supports a robust API lifecycle management strategy, ensuring that APIs are secure, compliant, and effectively managed throughout their operational lifespan.