Scan for APIs on This Computer (Desktop App)

Overview

The quickest way into API Discovery is to look at the computer you work on. Scan for APIs lists the programs that are listening for connections, works out which of them are APIs, and gives each one a suggested next step. You do not need to know which kind of source fits.

Three more tools help when a program publishes no description of its API:

• Capture its calls records one application's calls.
• Watch every app on this computer records the calls of every application.
• Also scan my network looks for APIs on other computers in your network. It is off until you switch it on.

These tools are built into the desktop app and have been unit-tested. They have not yet been run in the packaged desktop app on a wide range of machines, so expect rough edges and report them.

Before you begin

• Use the Shift-Left Studio desktop app. A web browser cannot see the computer you work on.
• Open Discovery from the header, then the Overview tab.
• For network scanning and capture, tell your security team first. Both can set off security tools.

Step 1 — Run a scan

1. On the Discovery Overview, select Scan for APIs.
2. The first time, the desktop app asks for your consent in its own window. Read the three lists it shows:
   • What it looks at. The programs listening for connections on this computer. Studio itself and the computer's own system services are set aside.
   • What it sends. A few plain requests to each program: its home page, the usual places where a program publishes its API description, and, for a GraphQL or MCP server, the question "what do you offer?". Requests go only to the program being looked at, on this computer.
   • What it never does. Sign in, call a tool, send your data, change anything, or keep what it reads. A scan keeps names, such as an address, a title and an operation count. It never keeps the contents of a page.
3. Agree to continue. Tick Don't ask again on this computer if you want later scans to start without the question.

How long a scan takes depends on the computer, so no duration is promised.

Step 2 — Read the results

Each program lands in one group, with one button.

Add creates an ordinary source that reads the program. Afterwards the card says Added, with See what it found and Remove what it added…. Removing erases the operations that only that source reported. Select Add again to bring them back.

Scan again shows what is new since the last scan and what is no longer running. An address you ignored stays ignored.

If Studio's server runs on another computer and cannot reach the program, Add uploads the document the scan already read. An MCP server cannot be added that way, and its card says so.

Step 3 — Capture its calls

Some applications send every call through one WebSocket, or publish no description at all. Use Capture its calls for those.

1. Select Capture its calls on the program's card.
2. Studio opens the application in its own window with a thin bar on top. The bar shows the application name, a clock and Stop.
3. Use the application as you normally would. A list fills in beside the bar with the kind of call, the call itself, how many times it happened and when it last happened.
4. Tick the calls you want and select Add N to inventory.

Good to know:

• No call goes into your inventory until you add it. Selecting Done erases the rest.
• Only calls to the application's own address are recorded. Calls to other hosts are counted and left out.
• Only names, counts and times are kept. A query value, header value, cookie or message is never kept. A call that carried a sign-in is marked sends a sign-in, and the sign-in itself is not stored.
• The captured calls become a source, with health, history and Remove like any other.
• A capture stops by itself after an hour.

Keep example answers

If your installation allows it, the capture asks one question first. A tick, off until you set it, reads Keep up to three sanitised example answers per API, so a mock can be made from them.

• Up to three JSON answers are kept per API, one for each status, up to 64 KB each.
• Personal and secret values are replaced with made-up ones before anything is stored. Recognition works by field name and shape, so it can miss a personal detail written in ordinary words. Read a mock before you publish it.
• Answers are never kept for production addresses. If Studio cannot tell, it keeps nothing.
• They are kept for you only, until 24 hours after the capture's last call or until you select Done.

Step 4 — Watch every app (optional)

Watch every app on this computer records what every application sends, the way a debugging proxy does. Calls are grouped by app, and you tick whole apps or single calls.

• It changes a setting while it runs. Your own proxy setting, not the machine-wide one, points at Studio. Studio puts it back when you select Stop, when the capture times out, and the next time Studio starts if it was closed in between. A banner stays on screen the whole time.
• Open a capture browser is the gentler option. It opens a separate Chrome or Edge window that is recorded, and changes no setting.
• Applications that ignore the system proxy are not seen. Use Capture its calls for those.
• Chrome does not send localhost through a proxy, so use the capture browser or Capture its calls for local apps.
• Available on Windows and macOS. On Linux, use Capture its calls.

Read HTTPS

Encrypted calls show only the host, until you select Enable Read HTTPS. Then, for the hosts you capture only:

• Studio makes a certificate on your computer that is valid for 30 days. It can vouch only for local and private-network names plus the hosts you are capturing.
• Studio asks, and then the computer asks, before it trusts the certificate. The capture browser trusts it without installing anything.
• Remove the certificate takes it away again. Uninstalling Studio removes it too.
• An application that refuses the certificate keeps working and shows as encrypted.

Step 5 — Scan the network (optional)

Under Scan for APIs, the Also scan my network switch is off until you turn it on. When it is on, the scan also looks for APIs on other computers in your network, asking each a short, fixed list of questions at a gentle pace.

• It may set off your organisation's security tools. Studio asks once more in its own window the first time.
• A finding on another computer is marked another computer.
• A large network may take longer than the scan's time limit. The results then say that not every computer was checked.
• Every network scan is written to the audit log with the addresses it contacted.
• An administrator can hide the switch for everyone. Then the server refuses a network scan too. No range larger than a /22 (1,024 addresses) is allowed.

What the assistant can do

The assistant can explain what a scan found and what a capture added. It cannot start a scan or a capture, because both look at or change your computer. They stay buttons you press.

Troubleshooting

• Nothing is found. The program may be bound to another computer's address, or it may be a program that Studio sets aside, such as a database. Check Not APIs, or ignored.
• A program shows "Needs your sign-in". Use Add it with a sign-in… and give the credential for that source.
• I stopped Watch every app and my proxy setting looks odd. Studio restores the setting on Stop, on timeout and at the next start. Restart Studio to trigger the restore.
• I cannot find the buttons. You are in a browser. Open the desktop app.

Related articles

• API Discovery
• Mocks: understanding and creating them
• Public address and desktop sharing