Akto
API Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Akto connector integrates with the Akto API Security Platform to synchronize API inventory and security testing data into Brinqa. Akto is a DAST (Dynamic Application Security Testing) tool for APIs that discovers API endpoints from live traffic, maintains an always-updated API inventory, and runs automated security tests covering the OWASP API Security Top 10, including BOLA, BFLA, SSRF, Injection, and 1000+ additional pre-built tests.
The connector synchronizes the following categories of data:
- Sites — API Collections grouping related endpoints (assets)
- API Endpoints — Discovered API endpoints across collections (assets)
- Dynamic Code Findings — Vulnerabilities found by automated security testing (findings)
- Dynamic Code Finding Definitions — Vulnerability test type/category definitions aligned to OWASP categories (finding definitions)
Data retrieved from Akto
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Site | Yes | Site |
| ApiEndpoint | Yes | Api Endpoint |
| DynamicCodeFinding | Yes | Dynamic Code Finding |
| DynamicCodeFindingDefinition | Yes | Dynamic Code Finding Definition |
Model relationships
For detailed steps on how to view the data retrieved from Akto in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Akto from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| API URL | No | https://app.akto.io | Akto API URL |
| API key | Yes | — | Akto API key |
| Page size | No | 100 | Maximum number of records to get per API request |
| Max retries | No | 5 | Maximum number of retry attempts before giving up a request |
| Parallel requests | No | min(4, availableProcessors) | Maximum number of parallel API requests |
| Collection names | No | — | Comma-separated list of Akto collection names to scope Finding sync to. Leave blank to include every collection |
Authentication
Method
API Key authentication. The key is sent as a custom header on every request — there is no token exchange step.
Endpoint
All Akto API endpoints use the POST method, even for read operations.
| Method | URL |
|---|---|
POST | https://{akto-dashboard-url}/api/{action} |
Request Headers
| Header | Value |
|---|---|
Content-Type | application/json |
X-API-KEY | <your-api-key> |
Usage
All API requests include the API key as a custom header:
X-API-KEY: <your-api-key>
Obtaining Credentials
Generate the API key from the Akto dashboard under My Account → Settings → Integrations → Akto API → Generate Token.
How to obtain Akto credentials
Obtain the required credentials (apiKey) from your Akto administrator or the Akto admin console, then enter them in the connection settings above.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Site
| Source Field Name | SDM Attribute |
|---|---|
apiCollections[].automated | AUTOMATED |
apiCollections[].description | DESCRIPTION |
apiCollections[].displayName or name | NAME |
apiCollections[].id | UID |
apiCollections[].startTs | FIRST_SEEN |
apiCollections[].type | COLLECTION_TYPE |
apiCollections[].urls | URL_PATTERNS |
apiCollections[].urlsCount | TOTAL_ENDPOINTS |
apiCollections[].vxlanId | VXLAN_ID |
| Constant | CATEGORIES |
| Derived from deactivated | STATUS |
| Sync time | LAST_CAPTURED |
ApiEndpoint
| Source Field Name | SDM Attribute |
|---|---|
apiInfoList[].actualAuthType | AUTH_TYPES |
apiInfoList[].allAuthTypesFound | ALL_AUTH_TYPES_FOUND |
apiInfoList[].apiType | API_TYPE |
apiInfoList[].collectionIds | ALL_COLLECTION_IDS |
apiInfoList[].description | DESCRIPTION |
apiInfoList[].discoveredTimestamp | FIRST_SEEN |
apiInfoList[].id.apiCollectionId | TARGETS |
apiInfoList[].id.method | METHOD |
apiInfoList[].id.url | PATH |
apiInfoList[].isSensitive | IS_SENSITIVE |
apiInfoList[].lastCalculatedTime | SCORE_CALCULATED_AT |
apiInfoList[].lastSeen | LAST_SEEN |
apiInfoList[].lastTested | LAST_ASSESSED |
apiInfoList[].responseCodes | RESPONSE_CODES |
apiInfoList[].riskScore | RISK_SCORE |
apiInfoList[].severityScore | SEVERITY_SCORE |
apiInfoList[].tagsList | TAGS |
apiInfoList[].threatScore | THREAT_SCORE |
| Constant | CATEGORIES |
| Derived from URL | HOST |
| Sync time | LAST_CAPTURED |
| {apiCollectionId}:{method}:{url} | UID |
| {method} {url} | NAME |
DynamicCodeFinding
| Source Field Name | SDM Attribute |
|---|---|
| Derived | SOURCE_STATUS |
| Derived from apiUrl | HOSTNAMES |
issueDetails[].apiMethod | METHOD |
issueDetails[].creationTime | FIRST_FOUND |
issueDetails[].issueUrl or apiUrl | URL |
issueDetails[].lastSeen | LAST_SEEN |
issueDetails[].status | PROVIDER_STATUS |
issueDetails[].testDescription | DESCRIPTION |
issueDetails[].testName | NAME |
issueDetails[].testSubCategory | TYPE |
| result query param in issueUrl, or composite fallback | UID |
| Sync time | LAST_CAPTURED |
| {apiCollectionId}:{apiMethod}:{apiUrl} | TARGETS |
DynamicCodeFindingDefinition
| Source Field Name | SDM Attribute |
|---|---|
| Derived | SEVERITY |
| Derived | SEVERITY_SCORE |
issueDetails[].testCategory | CATEGORIES |
issueDetails[].testCve | CVE_IDS |
issueDetails[].testCve | CVE_RECORDS |
issueDetails[].testCwe | CWE_IDS |
issueDetails[].testCwe | WEAKNESSES |
issueDetails[].testDescription | DESCRIPTION |
issueDetails[].testDetails | TEST_DETAILS |
issueDetails[].testImpact | IMPACT |
issueDetails[].testName | NAME |
issueDetails[].testReferences | REFERENCES |
issueDetails[].testRemediation | RECOMMENDATION |
issueDetails[].testSeverityFromTemplate or severity | SOURCE_SEVERITY |
issueDetails[].testSubCategory | UID |
issueDetails[].testTags | TAGS |
| Sync time | LAST_CAPTURED |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Site
Operation options
This object does not support any operation options.
Delta sync
The connector README does not document sync behavior for this object.
API
- Type: REST endpoint · Endpoint:
POST /api/getAllCollections
ApiEndpoint
Operation options
This object does not support any operation options.
Delta sync
The connector README does not document sync behavior for this object.
API
- Type: REST endpoint · Endpoint:
POST /api/fetchApiInfosForCollection
DynamicCodeFinding
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
filterStatus | Comma-separated list | Restricts the sync to issues with the given Akto statuses (e.g. OPEN,FIXED). Added to the request body only when set. | |
filterSeverity | Comma-separated list | Restricts the sync to issues with the given severities (e.g. CRITICAL,HIGH). Added to the request body only when set. |
Delta sync
The connector README does not document sync behavior for this object.
API
- Type: REST endpoint · Endpoint:
POST /api/fetchIssuesFromCollections
DynamicCodeFindingDefinition
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
filterStatus | Comma-separated list | Restricts the underlying issue fetch to the given Akto statuses (e.g. OPEN,FIXED). Added to the body only when set. | |
filterSeverity | Comma-separated list | Restricts the underlying issue fetch to the given severities (e.g. CRITICAL,HIGH). Added to the body only when set. |
Delta sync
The connector README does not document sync behavior for this object.
API
- Type: See connector README
Changelog
The Akto connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.0.0 | Overview The Akto connector integrates with Akto's API Security Platform to synchronize API inventory and automated security testing results. Category: API Security Models | N/A |