Looking to add protections for web application APIs.

Are there any good Open source API security tools?

Hi! I'm trying to improve on API security internally, not only just.. knowing what APIs we have (a mammoth task in itself some times), and scanning them, but finding if there is any unauthenticated endpoints.

So far I've found a tool called auto swagger which is free and seems fairly new. Does anyone have any other recommendations? Preferably one that's fully automated like this one, where I can just give it a schema and it scans the whole API?

https://github.com/intruder-io/autoswagger/

Im trying to practice security testing for APIs but I struggle finding good sample APIs. Please share your recommendations.

So I was assigned this task to explore security testing tools, and their requirement is that they would want to give only the main domain url like (reddit.com), with that it must be able to fetch all the APIs that are related or used in that website either in the frontend or backend and perform some security testing later on those APIs fetched or found

So my question is are there any tools like that, if so please comment below

I need simulate API-specific attacks with open source tools and evaluate an existing security toolchain in protecting your APIs

Does anyone have recommendations for solid open source vulnerability scanning tools?

Ideally something that can handle network and/or endpoint scanning and is relatively easy to deploy and maintain.

I’m currently learning how to build and interact with APIs, and I realized that half the challenge is actually testing them properly.

There are so many tools out there, and it’s a bit overwhelming to know which ones are actually worth learning when you’re starting out. I’d love to get advice from this community.

Here’s what I’ve found so far (please correct me if I’m missing something):

Postman → Probably the most popular. Great GUI, lots of tutorials.

Hoppscotch → A lightweight, open source alternative to Postman. Runs in the browser or self-hosted.

Bruno → Stores collections as plain text, easy to version control (great for teams).

Hurl → CLI-based, tests APIs using simple text files. Super clean for automation.

Yaak → Made by the original Insomnia founder. Sleek UI.

SoapUI → Bit older but strong if you need SOAP and more complex protocols.

Apidog → Similar to Postman, but I noticed it has a neat offline mode and works well for designing + mocking APIs.

Thunder Client (VS Code extension) → Really handy if you don’t want to leave your editor.

For someone still learning programming, what would you recommend focusing on first? Should I start with a GUI tool like Postman/Bruno/Hoppscotch, or dive straight into CLI stuff like Curl/Hurl to build stronger fundamentals?

Would love to hear what worked for you all when you were learning API testing.