ZAP understands API formats like JSON and XML and so can be used to scan APIs. The problem is usually how to effectively explore the APIs. There are various options: If your API has an OpenAPI/Swagger definition then you can import it using the OpenAPI add-on. If your API uses GraphQL then you can explore it using the GraphQL add-on. If your API has a WSDL then you can import it using the SOAP add-on. If you have a list of endpoint URLs then you can import these using the Import files contain...
