Review CORS configuration
Identify notable headers and response features as a starting point for testing the relevant application workflow.
Free API security check
Check your API’s CORS and security headers
Examine the externally visible configuration of a public API endpoint. Wolf-Agents checks CORS, API headers, error responses and other response signals. The findings and explanations give you a starting point for further technical review.
This is a limited endpoint check. It does not test authenticated user roles, access permissions or business logic, and it does not replace an API penetration test. Results, report files and optional result emails are currently in German.
Free report beta: no Wolf-Agents account and no email address required.
Check a public API endpoint
A+
A
B
C
D
F
Best grade within the check scope High risk
What you can do with the result
Inspect exposed information
See which server details, error information and security headers the endpoint returns.
Record the technical findings
Document the scan for a handover or your own later check after making changes.
What the API check covers
| Area | What the check says |
|---|---|
| CORS | Selected CORS headers and responses to the requests used by the check |
| API security headers | Security-related headers returned by the endpoint |
| Error responses | The response to a limited additional error probe and any exposed error messages |
| Server information | Externally visible server and technology details |
| Rate-limit headers | Visible signals about limits; no load test of whether they are enforced |
| HTTP methods | Visible method information and responses within the check’s defined request scope |
The check uses GET and OPTIONS requests. Its error probe appends a test path to the supplied URL and requests it with GET. It does not send a PATCH request. The check does not discover or inventory every endpoint in an API.
What this check leaves open
The check does not include authenticated testing, BOLA/IDOR tests, injection testing, business-logic tests, source-code analysis or a full penetration test. Rate-limit headers do not prove that limits hold under load. CORS does not replace server-side access controls.
This API check does not include a dedicated TLS analysis. It cannot establish the complete security of the transport layer or application.
Turn the API results into a report
The API report records the checked endpoint and scan time, with findings, explanations and measurement gaps. Save the PDF, add your own notes in DOCX or work with the findings table in CSV.
The available report files are free during the beta, with no email address required. Downloading a report does not run another check. All three formats use the same scan.
Sending a report by email is optional and unlocks no further content. Save the files you need locally: you can only download them again while the corresponding result is still available.
How to proceed
- Choose a public endpoint you are authorised to assess and start the check.
- Review the findings and decide whether the responses are informative for your intended use.
- Save the report if needed and add your own technical assessment. After making changes, you can start another scan yourself.
Questions about the API security check
Is this a comprehensive API security scanner?
It covers selected configuration and response features of a public endpoint. A broader API security testing service may also examine roles, access controls, objects, inputs and business logic. This check does not provide those tests.
Does it test for BOLA, IDOR or injection?
No. It does not switch between user roles, attempt cross-user access to protected objects or run injection test sequences.
Can I reproduce any CORS problem with it?
No. The tool uses a defined set of requests. It is not a freely configurable browser debugger for arbitrary origins, credentials, headers or application workflows. Investigate a specific CORS error in the affected workflow as well.
Does it send PATCH requests or change API data?
It uses GET and OPTIONS. The error probe uses GET on an added test path, rather than PATCH. Only check authorised targets: how a server reacts also depends on its implementation.
Does it prove that my rate limit works?
It assesses visible rate-limit headers. It does not run a load test and cannot prove that the limit is enforced when many requests arrive.
Can I integrate Wolf-Agents into my application through an API?
“API check” describes the target being checked. A customer API for integrating Wolf-Agents is not included in this offer.
What does a missing or blocked measurement mean?
An incomplete response, protective system or connection problem can limit a measurement. An unknown state is not a passed test. Consider these gaps before acting on a grade.