{"id":13765066,"url":"https://github.com/openclarity/apiclarity","last_synced_at":"2026-04-01T18:39:56.238Z","repository":{"id":37245062,"uuid":"402435051","full_name":"openclarity/apiclarity","owner":"openclarity","description":"An API security tool to capture and analyze API traffic, test API endpoints, reconstruct Open API specification, and identify API security risks. ","archived":false,"fork":false,"pushed_at":"2024-10-08T13:34:15.000Z","size":11161,"stargazers_count":561,"open_issues_count":54,"forks_count":71,"subscribers_count":19,"default_branch":"master","last_synced_at":"2026-02-15T06:24:06.356Z","etag":null,"topics":["api-security","envoy","istio","k8s","kubernetes","microservice","microservices","openapi","openapi-spec","openapi-specification","service-mesh","shadow-api","swagger","wasm","zombie-api"],"latest_commit_sha":null,"homepage":"https://apiclarity.io","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/openclarity.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-09-02T13:41:19.000Z","updated_at":"2026-02-13T12:09:23.000Z","dependencies_parsed_at":"2023-11-21T14:30:24.242Z","dependency_job_id":"998a5f07-d274-46a5-b0f9-887458e8456f","html_url":"https://github.com/openclarity/apiclarity","commit_stats":{"total_commits":270,"total_committers":32,"mean_commits":8.4375,"dds":0.8185185185185185,"last_synced_commit":"37aa375062605a2e5b516cf8356215b608ae4d6c"},"previous_names":["apiclarity/apiclarity"],"tags_count":49,"template":false,"template_full_name":null,"purl":"pkg:github/openclarity/apiclarity","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openclarity%2Fapiclarity","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openclarity%2Fapiclarity/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openclarity%2Fapiclarity/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openclarity%2Fapiclarity/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/openclarity","download_url":"https://codeload.github.com/openclarity/apiclarity/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openclarity%2Fapiclarity/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31290937,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-01T13:12:26.723Z","status":"ssl_error","status_checked_at":"2026-04-01T13:12:25.102Z","response_time":53,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["api-security","envoy","istio","k8s","kubernetes","microservice","microservices","openapi","openapi-spec","openapi-specification","service-mesh","shadow-api","swagger","wasm","zombie-api"],"created_at":"2024-08-03T16:00:33.499Z","updated_at":"2026-04-01T18:39:56.214Z","avatar_url":"https://github.com/openclarity.png","language":"Go","funding_links":[],"categories":["Tools"],"sub_categories":[],"readme":"# APIClarity\n\n![APIClarity](API_clarity.svg \"APIClarity\")\n\nAPIClarity is a modular tool that addresses several aspects of API Security, focusing specifically on [OpenAPI](https://spec.openapis.org/oas/latest.html) based APIs.\n\nAPIClarity approaches API Security in 2 different ways:\n- Captures all API traffic in a given environment and performs a set of security analysis to discover all potential security problems with detected APIs\n- Actively tests API endpoints to detect security issues in the implementation of such APIs.\n\n## OpenAPI automatic reconstruction\nBoth approaches described above are way more effective when APIClarity is primed with the OpenAPI specifications of the APIs analyzed or tested. However, not all applications have an OpenAPI specification available. For this reason one of the main functionality of APIClarity is the automatic reconstruction of OpenAPI specifications based on observed API traffic. In this case, users have the ability to review and approve the reconstructed specifications.\n\n## Security Modules\nAPIClarity is structured in a modular architecture, which allows to easily add new functionalities.\n\nIn the following a brief description of the modules currently implemented:\n\n- **Spec Diffs** This module compares the API traces with the OAPI specifications provided by the user or previously reconstructed. The result of this comparison provides:\n    - List of API endpoints that are observed but not documented in the specs, i.e. _Shadow APIs_;\n    - List of API endpoints that are observed but marked as deprecated in the specs, i.e. _Zombie APIs_;\n    - List of difference between of the APIs observed and their documented specification.\n- [**Trace Analyzer**](./backend/pkg/modules/internal/traceanalyzer/README.md) This module analyzes path, headers and body of API requests and responses to discover potential security issues, such as weak authentications, exposure of sensitive information, potential Broken Object Level Authorizations (BOLA) etc.\n- [**BFLA Detector**](./backend/pkg/modules/internal/bfla/README.md) This module detects potential Broken Function Level Authorization. In particular it observes the API interactions and build an authorization model that captures what clients are supposed to be authorized to make the various API calls. Based on such authorization model it then signals violations which may represent potential issues in the API authorization procedures.\n- **Fuzzer** This module actively tests API endpoints based on their specification attempting in discovering security issues in the API server implementation.\n\n## High level architecture\n\n![High level architecture](diagram.png \"High level architecture\")\n\n## Getting started\n\n### Supported traffic source integrations\n\nAPIClarity supports integrating with the following traffic sources. Install APIClarity and follow the instructions per required integration.\n\n* Istio Service Mesh\n  * Make sure that Istio 1.10+ is installed and running in your cluster.\n  See the [Official installation instructions](https://istio.io/latest/docs/setup/getting-started/#install)\n  for more information.\n\n* Tap via a DaemonSet\n  * [Integration instructions](https://github.com/openclarity/apiclarity/tree/master/plugins/taper)\n\n* Kong API Gateway\n  * [Integration instructions](https://github.com/openclarity/apiclarity/tree/master/plugins/gateway/kong)\n\n* Tyk API Gateway\n  * [Integration instructions](https://github.com/openclarity/apiclarity/tree/master/plugins/gateway/tyk)\n\n* OpenTelemetry Collector (traces only)\n  * [Integration instructions](https://github.com/openclarity/apiclarity/tree/master/plugins/otel-collector)\n\nThe integrations (plugins) for the supported traffic sources above are located in the [plugins directory within the codebase](https://github.com/openclarity/apiclarity/tree/master/plugins) and implement the [plugins API](https://github.com/openclarity/apiclarity/tree/master/plugins/api) to export the API events to APIClarity. To enable and configure the supported traffic sources, please check the ```trafficSource:``` section in [Helm values](https://github.com/openclarity/apiclarity/blob/master/charts/apiclarity/values.yaml).\nContributions of integrations with additional traffic sources are more than welcome!\n\n### Install APIClarity in a K8s cluster using Helm:\n\n1. Add Helm repo\n\n   ```shell\n   helm repo add apiclarity https://openclarity.github.io/apiclarity\n   ```\n\n2. Save APIClarity default chart values\n\n    ```shell\n    helm show values apiclarity/apiclarity \u003e values.yaml\n    ```\n\n3. Update `values.yaml` with the required traffic source values\n\n4. Deploy APIClarity with Helm for the selected traffic source\n\n   ```shell\n   helm install --values values.yaml --create-namespace apiclarity apiclarity/apiclarity -n apiclarity\n   ```\n\n5. Port forward to APIClarity UI:\n\n   ```shell\n   kubectl port-forward -n apiclarity svc/apiclarity-apiclarity 9999:8080\n   ```\n\n6. Open APIClarity UI in the browser: \u003chttp://localhost:9999/\u003e\n7. Generate some traffic in the traced applications and check the APIClarity UI :)\n\n### Uninstall APIClarity from a K8s cluster using Helm:\n\n1. Helm uninstall\n\n   ```shell\n   helm uninstall apiclarity -n apiclarity\n   ```\n\n2. Clean resources\n\n    By default, Helm will not remove the PVCs and PVs for the StatefulSets. Run the following command to delete them all:\n\n    ```shell\n    kubectl delete pvc -l app.kubernetes.io/instance=apiclarity -n apiclarity\n    ```\n\n## Configurations\n\nThe file [values.yaml](https://github.com/openclarity/apiclarity/blob/master/charts/apiclarity/values.yaml) is used to deploy and configure APIClarity on your cluster via Helm.\n[This ConfigMap](https://github.com/openclarity/apiclarity/blob/master/charts/apiclarity/templates/configmap.yaml) is used to define the list of headers to ignore when reconstructing the spec.\n\n## Testing with a demo application\n\nA good demo application to try APIClarity with is the [Sock Shop Demo](https://microservices-demo.github.io/).\n\nTo deploy the Sock Shop Demo, follow these steps:\n\n1. Create the `sock-shop` namespace and enable Istio injection:\n\n   ```shell\n   kubectl create namespace sock-shop\n   kubectl label namespaces sock-shop istio-injection=enabled\n   ```\n\n2. Deploy the Sock Shop Demo to your cluster:\n\n   ```shell\n   kubectl apply -f https://raw.githubusercontent.com/microservices-demo/microservices-demo/master/deploy/kubernetes/complete-demo.yaml\n   ```\n\n3. Deploy APIClarity in the `sock-shop` namespace (e.g. Istio service-mesh traffic source):\n\n   ```shell\n   helm repo add apiclarity https://openclarity.github.io/apiclarity\n   ```\n\n   ```shell\n   helm install --set 'trafficSource.envoyWasm.enabled=true' --set 'trafficSource.envoyWasm.namespaces={sock-shop}' --create-namespace apiclarity apiclarity/apiclarity -n apiclarity\n   ```\n\n4. Port forward to Sock Shop's front-end service to access the Sock Shop Demo App:\n\n   ```shell\n   kubectl port-forward -n sock-shop svc/front-end 7777:80\n   ```\n\n   Open the Sock Shop Demo App UI in the browser (\u003chttp://localhost:7777/\u003e) and run\n   some transactions to generate data to review on the APIClarity dashboard.\n\n## Building\n\n### Building from source:\n\nBuild and push the image to your repo:\n\n```shell\nDOCKER_IMAGE=\u003cyour docker registry\u003e/apiclarity DOCKER_TAG=\u003cyour tag\u003e make push-docker\n```\n\nUpdate [values.yaml](https://github.com/openclarity/apiclarity/blob/master/charts/apiclarity/values.yaml) accordingly.\n\n## Running locally with demo data\n\n1. Build UI \u0026 backend locally as described above:\n\n   ```shell\n   make ui \u0026\u0026 make backend\n   ```\n\n2. Copy the built site:\n\n   ```shell\n   cp -r ./ui/build ./site\n   ```\n\n3. Run backend and frontend locally using demo data:\n\n   Note: You might need to delete the old local state file and local db:\n\n   ```shell\n   rm state.gob; rm db.db\n   ```\n\n   ```shell\n   DATABASE_DRIVER=LOCAL K8S_LOCAL=true FAKE_TRACES=true FAKE_TRACES_PATH=./backend/pkg/test/trace_files \\\n   ENABLE_DB_INFO_LOGS=true ./backend/bin/backend run\n   ```\n   Note: this command requires a proper KUBECONFIG in your environment when __K8S_LOCAL=true__ is used. If you want to run without k8s, use __ENABLE_K8S=false__ instead.\n\n4. Open APIClarity UI in the browser: \u003chttp://localhost:8080/\u003e\n\n## Enabling External Trace Sources Support\nEnabling external trace sources support, APIClarity can receive the trace sources from the entitites that are external to the K8s cluster. External trace sources such as Gateways, Load balancers, etc. can communicate with APIClarity to report APIs and send the traces. \n\nThe following section describes how to deploy APIClarity with the support for external trace sources\n1.\tAdd Helm Repo\n```shell\nhelm repo add apiclarity https://openclarity.github.io/apiclarity\n```\n\n2.\tUpdate values.yaml with \n```shell\nApiclarity -\u003e tls -\u003e enabled as true\nsupportExternalTraceSource -\u003e enabled as true\n```\n\n3.\tDeploy APIClarity with the Helm enabling external traffic sources\n```shell\nhelm install --values values.yaml --create-namespace apiclarity apiclarity/apiclarity -n apiclarity\n```\n\n4.\tPort forward to APIClarity UI:\n```shell\nkubectl port-forward -n apiclarity svc/apiclarity-apiclarity 9999:8080\n```\n\n5.\tOpen APIClarity UI in the browser:\n```shell\nhttp://localhost:9999 \n```\n\nThe following section describes how to register a new external trace source. And this section includes how to access the service, register a new trace source, and how to receive the token and certificate.\n1.\tPort forward for service at 8443\n```shell\nkubectl port-forward -n apiclarity svc/apiclarity-apiclarity 8443:8443\n```\n\n2.\tRegister a new external trace source and receive the token \n```shell\nTRACE_SOURCE_TOKEN=$(curl --http1.1 --insecure -s -H 'Content-Type: application/json' -d '{\"name\":\"apigee_gateway\",\"type\":\"APIGEE_X\"}' https://localhost:8443/api/control/traceSources|jq -r '.token')\n```\n\n3. Receive the certificate\nTo receive the certificate, get the External-IP for the service named as apiclarity-external\n```shell\nkubectl get services -n apiclarity\n```\nThen, use the External-IP address with the following command, then extract the certificate with -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- and save to server.crt\n```shell\nopenssl s_client -showcerts -connect \u003cExternal-IP\u003e:10443\n```\n\nUse the above extracted token at the step-2 and certificate at step-3 for configuring subsequent external trace sources such as Apigee X Gateway and BIG-IP LTM Load balancer\n\n## Supported Trace Sources\nAPIClarity can support with the following trace sources and follow the instructions per required integration.\n\n* Apigee X Gateway\n  * [Integration instructions](https://github.com/openclarity/apiclarity/tree/master/plugins/gateway/apigeex)\n* BIG-IP LTM Load balancer\n  * [Integration instructions](https://github.com/openclarity/apiclarity/tree/master/plugins/gateway/f5-bigip)\n* Kong\n  * [Integration instructions](https://github.com/openclarity/apiclarity/tree/master/plugins/gateway/kong)\n* Tyk\n  * [Integration instructions](https://github.com/openclarity/apiclarity/tree/master/plugins/gateway/tyk)\n\n## Contributing\n\nPull requests and bug reports are welcome.\n\nFor larger changes please create an Issue in GitHub first to discuss your\nproposed changes and possible implications.\n\n## Contributors\n\nhttps://panoptica.app\n\n## License\n\n[Apache License, Version 2.0](https://www.apache.org/licenses/LICENSE-2.0)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenclarity%2Fapiclarity","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fopenclarity%2Fapiclarity","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenclarity%2Fapiclarity/lists"}