API security check
Point ovuGuards at your API's base URL and get a clear report of common misconfigurations: things like data returned without a login, CORS that trusts any website, or error messages that leak internals. It's built for startups and fintech teams shipping fast.
Check my API free Free account needed. No card.
What ovuGuards checks in an API
- HTTPS and TLS: plain-HTTP APIs, certificate problems and outdated TLS versions.
- Authentication: whether the endpoint returns data without any credentials.
- CORS: wildcard origins, reflected origins with credentials, and the risky null origin.
- Exposed documentation: public Swagger/OpenAPI or GraphQL schemas at common paths.
- Error leakage: stack traces and framework details in error responses.
- Rate limiting and caching: missing rate-limit headers and Cache-Control on sensitive responses.
- Security headers: the same header checks as our free headers checker.
How it works
- Create a free account.
- Choose "API" and enter the base URL.
- Fix what the report finds, then scan again or set up monitoring.
Want a quick look first? Run the free website check on your API's domain. No account needed.
Frequently asked questions
Is the API security check free?
Yes. The Free plan includes 3 scans a month, and an API scan counts as one. Create a free account to run it.
Will the scan attack or overload my API?
No. It is passive and rate-limited: normal requests that read responses and headers. There's no fuzzing, brute forcing or exploit payloads.
Which APIs can I scan?
Any HTTP or HTTPS API you own or are allowed to test, such as REST or JSON endpoints, payment or wallet backends, and mobile app backends.
Does it test endpoints behind a login?
The passive scan looks at what an unauthenticated client sees, which is often where the most serious leaks are.