REST API Discovery

REST API Discovery

Vespasian classifies REST endpoints from captured HTTP traffic and generates OpenAPI 3.0 specifications.

Classification Heuristics

Vespasian uses the following signals to identify REST API calls and separate them from static assets:

1. Content-type: Responses with application/json or application/xml
2. Static asset exclusion: Drops .js, .css, .png, .woff, /static/, /assets/
3. Path heuristics: /api/, /v1/, /v2/, /v3/, /rest/, /rpc/ paths boost confidence
4. HTTP method: POST/PUT/PATCH/DELETE to non-page URLs
5. Response structure: JSON object or array bodies (not HTML)

Output Format

REST APIs are output as OpenAPI 3.0 specifications in YAML or JSON format.

Path Normalization

Vespasian normalizes dynamic path segments into parameters:

• /users/42 and /users/87 become /users/{id}
• Known literals like /me and /self are preserved

Active Probing

When probing is enabled (default), Vespasian enriches REST endpoints with:

• OPTIONS discovery — Discovers allowed HTTP methods
• JSON schema inference — Infers request/response schemas from observed traffic

Example Workflow

# One-step REST discovery
vespasian scan https://app.example.com --api-type rest -o api.yaml

# Two-stage workflow
vespasian crawl https://app.example.com -o capture.json
vespasian generate rest capture.json -o api.yaml

See Also

• GraphQL Discovery
• SOAP WSDL Discovery
• CLI Reference