forallsecure/Mayhem for API
Automatically test your REST APIs with your OpenAPI specs and Postman collections
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| mayhem-token | Mayhem token | — | — |
| api-url | URL pointing to your running API you started before calling this action (don't fuzz your production API!) | yes | — |
| api-spec | Path to your Swagger 2.0 or OpenAPI 3.0 specification, or your Postman collection. Can be a URL. | yes | — |
| target | The organization-scoped name of your target, such as example/my-test-target. Auto-generated from your GitHub Repository name if unspecified. | — | — |
| zap-api-scan | Include results from ZAP - API Scan. This run ZAP - API Scan and merge the results with your Mayhem for API results. | — | false |
| duration | Scan duration | — | auto |
| sarif-report | SARIF output path. You can upload it to GitHub using the 'github/codeql-action/upload-sarif@v1' action | — | — |
| html-report | HTML output path. You can upload the artifact to GitHub using the 'actions/upload-artifact@v4' action | — | — |
| experimental-rewrite-plugin | --experimental-rewrite-plugin option value | — | — |
| experimental-classify-plugin | --experimental-classify-plugin option value | — | — |
| github-token | github token for posting feedback | no | ${{ github.token }} |
| run-args | A list of additional arguments (separated by '\n') to include in the call to 'mapi run'. Run 'mapi run --help' for a complete list of arguments. | — | — |
| mayhem-url | Mayhem API override. | https://app.mayhem.security | — | — |
Outputs
no outputs