{"id":28520564,"url":"https://github.com/idealo/spring-endpoint-exporter","last_synced_at":"2026-06-27T21:00:50.995Z","repository":{"id":36984924,"uuid":"415060733","full_name":"idealo/spring-endpoint-exporter","owner":"idealo","description":"A command-line utility that allows you to export all Endpoints of your Spring Boot Application in OpenAPI 3 format by scanning for specific classes in a jar file or on the file system without actually loading them.","archived":false,"fork":false,"pushed_at":"2026-05-11T11:18:37.000Z","size":341,"stargazers_count":9,"open_issues_count":1,"forks_count":3,"subscribers_count":7,"default_branch":"main","last_synced_at":"2026-05-11T13:29:24.354Z","etag":null,"topics":["api-extractor","asm","classpath-scanner","classpath-scanning","scanner","spring-boot","spring-endpoint-exporter"],"latest_commit_sha":null,"homepage":"","language":"Kotlin","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/idealo.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2021-10-08T16:43:33.000Z","updated_at":"2026-05-11T11:18:58.000Z","dependencies_parsed_at":"2023-02-18T02:01:19.552Z","dependency_job_id":"21993789-d98d-4d57-959e-e0963d9eef60","html_url":"https://github.com/idealo/spring-endpoint-exporter","commit_stats":null,"previous_names":[],"tags_count":54,"template":false,"template_full_name":null,"purl":"pkg:github/idealo/spring-endpoint-exporter","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/idealo%2Fspring-endpoint-exporter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/idealo%2Fspring-endpoint-exporter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/idealo%2Fspring-endpoint-exporter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/idealo%2Fspring-endpoint-exporter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/idealo","download_url":"https://codeload.github.com/idealo/spring-endpoint-exporter/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/idealo%2Fspring-endpoint-exporter/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34867616,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-27T02:00:06.362Z","response_time":126,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["api-extractor","asm","classpath-scanner","classpath-scanning","scanner","spring-boot","spring-endpoint-exporter"],"created_at":"2025-06-09T07:07:26.655Z","updated_at":"2026-06-27T21:00:50.987Z","avatar_url":"https://github.com/idealo.png","language":"Kotlin","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![Build](https://github.com/idealo/spring-endpoint-exporter/actions/workflows/build.yml/badge.svg)](https://github.com/idealo/spring-endpoint-exporter/actions/workflows/build.yml)\n[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=spring-endpoint-exporter\u0026metric=alert_status)](https://sonarcloud.io/summary/new_code?id=spring-endpoint-exporter)\n\n# Spring Endpoint Exporter\n\nSpring Endpoint Exporter aims to increase the value of your dynamic security scans by exporting all endpoints from\na [Spring Boot](https://github.com/spring-projects/spring-boot) application in [OpenAPI 3 format](https://swagger.io/docs/specification/about/), so that\nscanners like [ZAP](https://github.com/zaproxy/zaproxy) can use this information to yield better results.\n\n## How does it work?\n\nFirst, it extracts metadata from class files using [ASM](https://asm.ow2.io/). It then processes the metadata and\napplies [Spring Boot](https://github.com/spring-projects/spring-boot) specific rules. Finally, the collected information is converted\ninto [OpenAPI 3 format](https://swagger.io/docs/specification/about/) and written to a file. This file can now be used, for example\nwith [ZAP](https://github.com/zaproxy/zaproxy), to dynamically scan an application for security issues.\n\n## How to run it using docker-compose\n\nFind the latest docker image [here](https://github.com/idealo/spring-endpoint-exporter/pkgs/container/spring-endpoint-exporter).\n\n```yaml\nservices:\n  spring-endpoint-exporter:\n    image: ghcr.io/idealo/spring-endpoint-exporter:1.0.25-native\n    mem_reservation: 64M\n    mem_limit: 128M\n    volumes:\n      - /path/to/your/jar:/data\n    environment:\n      - EXPORTER_INCLUDE_FILTERS=de.idealo.*\n      - EXPORTER_INPUT_PATH=/data/app.jar\n      - EXPORTER_OUTPUT_PATH=/data/out.json\n```\n\nThe above configuration would extract all spring endpoints inside the `de.idealo` package for `/path/to/your/jar/app.jar`\nto `/path/to/your/jar/out.json`.\n\nPlease note that the container uses user `1000:1000`. Make sure that this user has read and write permissions on the volume, in this case `/path/to/your/jar`.\n\n## Configuration Properties\n\n| Property                   | Type           | Description                                                                                                                                                                                                                     | Default value       |\n|----------------------------|----------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------|\n| `exporter.scan-mode`       | `ScanMode`     | The mode the exporter will operate in. Either `JAR` or `FILE_SYSTEM`.\u003cbr/\u003e\u003cbr/\u003e `JAR` mode expects input-path to point to a valid jar. `FILE_SYSTEM` expects input-path to point the a directory that contains `*.class` files. | `\"JAR\"`             |\n| `exporter.input-path`      | `Path`         | The jar or directory with class files to scan and export all request mappings from.                                                                                                                                             | `null`              |\n| `exporter.output-path`     | `Path`         | Where to output the result of the exporter.                                                                                                                                                                                     | `\"./open-api.json\"` |\n| `exporter.include-filters` | `Set\u003cPattern\u003e` | A set of packages to include when scanning for request mappings.                                                                                                                                                                | `null`              |\n| `exporter.exclude-filters` | `Set\u003cPattern\u003e` | A set of packages to exclude when scanning for request mappings.                                                                                                                                                                | `null`              |\n\nYou can pass properties to the application using environment variables or command line arguments. E.g.:\n\n```\nexport EXPORTER_INPUT_PATH=/data/app.jar\njava -jar ./spring-endpoint-exporter-1.0.25.jar\n```\n\nor\n\n```\njava -jar ./spring-endpoint-exporter-1.0.25.jar --exporter.input-path=\"/data/app.jar\" --exporter.include-filters=\"de.idealo.*\"\n```\n\n## Building from source\n\n### Jar File\n\nSimply run the following command:\n\n```\n./mvnw clean package\n```\n\nYou can now run the application using:\n\n```\njava -jar ./target/spring-endpoint-exporter-1.0.25.jar\n```\n\n### Docker Image\n\nMake sure your docker daemon is running and run the following command:\n\n```\n./mvnw clean spring-boot:build-image\n```\n\nThe resulting image is named `ghcr.io/idealo/spring-endpoint-exporter:1.0.25`.\n\n### Native Docker Image\n\n| ⓘ Note                                                                     |\n|:---------------------------------------------------------------------------|\n| The native image is currently only compatible with the `x86` architecture. |\n\nMake sure your docker daemon is running and run the following command:\n\n```\n./mvnw -Pnative clean spring-boot:build-image\n```\n\nThe resulting native image is named `ghcr.io/idealo/spring-endpoint-exporter:1.0.25-native`.\n\n## Known limitations\n\nSince this tool only accesses information from the bytecode, and thus does not load classes, it does not pick up custom `@RequestMapping` annotations, e.g.:\n\n[//]: # (@formatter:off)\n```java\n@Documented\n@Target(ElementType.METHOD)\n@Retention(RetentionPolicy.RUNTIME)\n@RequestMapping(method = RequestMethod.GET)\npublic @interface CustomRequestMapping {\n\n    @AliasFor(annotation = RequestMapping.class)\n    String name() default \"\";\n\n    @AliasFor(annotation = RequestMapping.class)\n    String[] value() default {};\n\n    @AliasFor(annotation = RequestMapping.class)\n    String[] path() default {};\n\n    @AliasFor(annotation = RequestMapping.class)\n    String[] params() default {};\n\n    @AliasFor(annotation = RequestMapping.class)\n    String[] headers() default {};\n\n    @AliasFor(annotation = RequestMapping.class)\n    String[] consumes() default {};\n\n    @AliasFor(annotation = RequestMapping.class)\n    String[] produces() default {};\n}\n```\n[//]: # (@formatter:on)\n\nHowever, it correctly handles the builtin variants of `@RequestMapping`, e.g.: `@GetMapping`, `@PostMapping`, `@PutMapping`, `@DeleteMapping`\nand `@PatchMapping`.\n\n## License\n\nThis project is licensed under the Apache-2.0 License. See the [LICENSE](LICENSE) file for the full license text.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fidealo%2Fspring-endpoint-exporter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fidealo%2Fspring-endpoint-exporter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fidealo%2Fspring-endpoint-exporter/lists"}