New · Traffic Capture

Turn captured traffic into a scannable API asset.

Already have a HAR file, Burp Suite history, or ZAP session? Traffic Capture filters it to your target server, templates the paths, strips credentials, and generates an OpenAPI asset you review before anything is uploaded.

Try Traffic Capture See how it works

HAR .harBurp Suite .xmlZAP .txtAvailable on paid plans

Input

XML

shop.burp.xml

Burp Suite · 145 KB

158

requests

Filter

api.shop.test only

−38 hosts

Template

IDs → {params}

120 → 9

Strip

Credential headers

3 removed

Output · OpenAPI 3.0.3

9 operations

GET/orders/{order_id}/items/{item_id}
GET/products/{product_id}/reviews
POST/products/{product_id}/reviews
GET/users/{user_id}/orders
PATCH/orders/{order_id}

+ 4 more operations

Raw capture processed in your browser. Only the approved OpenAPI is uploaded.

The gap

You already captured the traffic. Your API inventory is still empty.

Pentests, QA runs, and DevTools sessions record the real API surface. Rewriting that history as a spec by hand is the step that rarely happens.

API inventory

0 endpoints

No endpoints yet

158 requests captured → 0 documented

Supported captures

Bring the export you already have.

Traffic Capture reads the three formats security and engineering teams produce most often, so there is nothing new to install or record.

.har

HAR

Browser DevTools

Save the Network panel recording from Chrome, Firefox, Edge, or Safari as a HAR file.

.xml

Burp Suite

Save items as XML

Select requests in Burp's HTTP history and save the items as an XML export.

.txt

ZAP

Saved messages

Save the messages from your OWASP ZAP session to a text file.

How it works

From raw capture to reviewed OpenAPI in four steps.

Step 01 / 04
Drop in your capture.
Create a new asset, choose Traffic Capture, and enter the target server you want to document. Then drop in the .har, .xml, or .txt export you already have.
- HAR, Burp Suite XML, and ZAP exports
- The capture format is detected for you
- The target server scopes the result
Create asset
New
OpenAPI
Upload a spec
Postman
Import a collection
Traffic Capture
HAR, Burp or ZAP export
Target server
api.shop.test
XML
shop.burp.xml
Burp Suite · 145 KB
Burp Suite XML detected142 KB / 145 KB
kept 120·other hosts 38
Processed in your browser; only the generated OpenAPI is uploaded.
Generate OpenAPI
Step 02 / 04
Filtered right in your browser.
ApyGuard reads the capture locally and keeps only the requests sent to your target server. Fonts, CDNs, analytics beacons, and other third-party hosts are dropped.
- The raw file never leaves your browser
- Only target-server requests are kept
- Progress is shown while the file is read
Burp Suite XML detected142 KB / 145 KB
kept 120·other hosts 38
GETapi.shop.test/products
GETapi.shop.test/orders/64518
POSTmetrics.tracker.io/v2/collectother host
GETapi.shop.test/products/52507
GETapi.shop.test/orders/40509/items/23011
GETfonts.cdnhost.net/css2?family=Interother host
GETcdn.shop.test/static/app.4f2c.jsother host
POSTapi.shop.test/products/71058/reviews
The raw file never leaves your browser.
Step 03 / 04
Patterns in. Secrets out.
Requests that differ only by an identifier collapse into one templated operation, and credential headers are stripped before the OpenAPI document is generated.
- /orders/32488 becomes /orders/{order_id}
- Authorization, Cookie, and X-API-Key removed
- Many requests become one clean operation
Path templates
GET/orders/32488
GET/orders/3841
GET/orders/64518
GET/orders/40509
GET/orders/23011
GET/orders/{order_id}
5 requests → 1 operation
Request headers
Authorization:Bearer tok-shop-1-••••••REMOVED
Cookie:session=7f3a9c0e••••REMOVED
X-API-Key:ak_9f2c71b0••••REMOVED
Step 04 / 04
Review it. Then approve.
Inspect the generated OpenAPI 3.0 document before anything is uploaded. Approve it to create the asset, download it for your own tooling, or start over.
- Full spec preview before upload
- Approve & upload, download, or start over
- Example values flagged for your review
Review the generated OpenAPI
api.shop.test · 9 operations from 120 requests · Burp · 9 KB
Secrets are removed. Other example values (such as emails) come from your traffic; review them before uploading.
1{
2 "openapi": "3.0.3",
3 "info": { "title": "Observed traffic: api.shop.test" },
4 "servers": [{ "url": "https://api.shop.test" }],
5 "paths": {
6 "/orders/{order_id}/items/{item_id}": { "get": … },
7 "/products/{product_id}/reviews": { "get": …, "post": … },
8 "/users/{user_id}/orders": { "get": … },
9 "/orders/{order_id}": { "get": …, "patch": … },
10 "/products/{product_id}": { "get": … },
Approve & uploadDownloadStart over
Upload successful
9 endpoints

Asset created

One capture. A full asset, ready to scan.

The approved OpenAPI becomes a regular ApyGuard asset. Start a scan to test authorization, authentication, and OWASP API Top 10 risks across every operation your capture revealed.

Explore API security testing

api.shop.test

Source: Traffic Capture · Burp Suite

Start scan

GET/orders/{order_id}/items/{item_id}
GET/products/{product_id}/reviews
POST/products/{product_id}/reviews
GET/users/{user_id}/orders
PATCH/orders/{order_id}
GET/orders/{order_id}
GET/products/{product_id}
GET/products
POST/carts

Privacy by design

Built for captures that contain secrets.

Proxy histories are full of tokens and session cookies. Traffic Capture keeps the raw file on your machine and only uploads what you approve.

Processed in your browser

Parsing, host filtering, and path templating run locally. The raw capture file is never uploaded to ApyGuard.

Credentials stripped

Authorization, Cookie, and API-key headers are removed before the OpenAPI document is generated.

Nothing ships without approval

You see the full OpenAPI before upload. Approve it, download it for your own tooling, or start over.

Credential headers are removed, but other example values, such as email addresses, come from your recorded traffic. Review the generated document before you approve the upload.

Build your inventory

Start from whatever you already have.

Traffic Capture is one of several ways to bring an API into ApyGuard. Pick the starting point that matches the material on hand.

You have a capture file

Traffic Capture

Convert HAR, Burp Suite, or ZAP exports into a reviewed OpenAPI asset.

This page

You can click through the app

Chrome Extension

Record API calls during live browser journeys and export the endpoints.

You have the backend source

APIScout for VS Code

Discover routes from source code and export OpenAPI from the editor.

You already have a spec

OpenAPI Blueprint

Review an existing OpenAPI contract for schema and documentation gaps.

FAQ

Traffic Capture questions

Still deciding which capture to bring? Talk to the team.

What is Traffic Capture in ApyGuard?

Traffic Capture creates an ApyGuard API asset from HTTP traffic you have already recorded. Drop in a HAR file, a Burp Suite XML export, or a ZAP messages file, and ApyGuard generates an OpenAPI document for your target server that you review before it becomes a scannable asset.

Which capture formats does Traffic Capture support?

HAR files exported from browser DevTools, Burp Suite items saved as XML, and OWASP ZAP messages saved as a .txt file.

Is my capture file uploaded to ApyGuard?

No. The capture is parsed, filtered, and converted in your browser. Only the generated OpenAPI document is uploaded, and only after you review and approve it.

Which secrets are removed from the generated OpenAPI?

Credential headers such as Authorization, Cookie, and API-key headers like X-API-Key are removed. Other example values, such as email addresses, come from your recorded traffic, so review the generated document before uploading it.

What happens to requests sent to other hosts?

You set a target server when you create the asset. Requests to other hosts, such as CDNs, font providers, and analytics services, are filtered out, so the OpenAPI only describes the API you want to test.

How are path parameters detected?

Requests that share the same path shape but differ in identifier segments are grouped into one templated operation. For example, GET /orders/32488 and GET /orders/3841 become GET /orders/{order_id}.

Can I download the OpenAPI instead of uploading it?

Yes. The review step lets you approve and upload the document as an asset, download it, or start over with a different capture.

Which plans include Traffic Capture?

Traffic Capture is available on paid ApyGuard plans. See the pricing page for current plan details.