In addition to the user-friendly Invicti user interface, all Invicti functionality is also available through a built-in REST API. The REST API is available immediately upon installation and requires no configuration at all. All you need to do is open the Invicti GUI to get the API key and you can start using the Invicti REST API.
Integration with the Invicti REST API
The primary reason why businesses choose to use the Invicti REST API is to be able to integrate the scanner with custom systems. Invicti has out-of-the-box integrations for many solutions, for example, several issue trackers including Jira, as well as CI/CD tools like Jenkins. However, in the case of other products, custom integrations are required.
If other products also have a REST interface, you can use any appropriate language to build scripts, which access Invicti through the REST interface, execute scans, get vulnerability data, and then provide this data to other tools. For example, you can use the Invicti REST API to get web application firewall export files and then upload them directly to the web application firewall using the WAF REST API.
Automation with the Invicti REST API
Another reason why businesses choose to use the Invicti REST API instead of the GUI is automation. While Invicti provides internal scheduling capabilities and the continuous scanning function, which performs critical scans daily and deep scans weekly, some customers may prefer more automation capabilities.
For example, you may want to run an Invicti scan automatically after an update of the website. For this purpose, you can create a script that is activated upon detecting any changes in the content of a particular web page and that runs the Invicti scan to immediately check if those changes introduced any vulnerabilities.
Another automation option would be to run an Invicti script after the web application is built using a custom CI/CD environment. If you use Jenkins, that option is available out-of-the-box, but if you use other CI/CD tools, it’s also possible to include Invicti in your SDLC. All you need to do is to create a custom script that works with your CI/CD platform.
Invicti REST API Examples
- Example Bash Script for the Invicti REST API
- Example PowerShell Script for the Invicti REST API
- Example Python Script for the Invicti REST API
- An advanced example of using the Invicti REST API with Python
Get the latest content on web security
in your inbox each week.
THE AUTHOR
Principal Cybersecurity Writer
