For an API endpoint asset, the asset page has an API scope tab. Tell TasScan which operations to look at by:
- uploading an OpenAPI 3.x or Swagger 2.0 file (JSON or YAML, up to 1 MiB),
- giving a specification URL on the asset's own host,
- listing endpoints, one per line, for example
GET /health, or - importing a Postman collection v2.1.
The tab shows how many operations were found, how many will be probed and how many are excluded, with the reason for each.
What a Deep scan does with the scope
It calls each read-only operation (GET, HEAD, OPTIONS) once, without credentials, on your asset's host and inside the usual scan limits. It reports:
- operations documented as protected that answer successfully without credentials,
- stack traces, database errors and internal paths in responses,
- responses whose content type or JSON shape differ from the specification.
Operations that could not be checked (timeouts, server errors, rate limiting) are shown as inconclusive, never as passed.
What it never does
- Call POST, PUT, PATCH, DELETE or any other write method.
- Call routes whose name suggests a state change (logout, delete, reset, checkout, cancel, webhook, export and similar) or that you mark with
x-tasscan-skip. - Guess parameter values. Operations with required parameters are probed only when the specification documents an example value.
- Send credentials, tokens or cookies, follow references to other files or hosts, or contact any host other than your asset's.
This is not an authorization, business-logic, injection or permission-matrix test. A clean result means the documented read-only routes behaved as described to an anonymous visitor, nothing more. Imported documents are not stored; only the parsed operation list and a hash are kept.