MuleSoft Anypoint Exchange

This feature is available with Invicti API Security Standalone or Bundle

Integrating Invicti Platform with MuleSoft Anypoint Exchange allows you to fetch Swagger2, OpenAPI3, and RAML specification files from MuleSoft to build an inventory of API endpoints that can be scanned for vulnerabilities with our DAST scanners. The integration leverages Connected Apps, where Invicti is the application that integrates via user account with MuleSoft Anypoint Exchange.

This document explains how to set up an integration between MuleSoft Anypoint Exchange and Invicti Platform.

Step 1: Ensure you have a MuleSoft Anypoint Exchange account

In order for Invicti to successfully fetch your Swagger2, OpenAPI3, and RAML specification files from MuleSoft, you need to have a Mulesoft Anypoint Exchange account that contains your API specification files. This account will be used to facilitate creating a Connected App integration between Invicti and MuleSoft Anypoint Exchange, which will import and sync your API specifications.

The integration will use the Connected App to access the following filter scopes:

• Exchange Viewer 
• Profile 
• Background Access (this is necessary for the refresh token functionality)

Once you have a MuleSoft Anypoint Exchange account, continue with step 2 below.

Step 2: Configure the API import source in Invicti

Now that you have access to MuleSoft Anypoint Exchange, you are ready to set up the MuleSoft integration in Invicti to import your API specification files.

1. Select Discovery > Configuration from the left-side menu. Then navigate to API sources.

2. Click Add source.
3. Enter a name for the API integration and select MuleSoft as the source type.

4. Click Authenticate and Save. You will be directed to your MuleSoft account to authorize the integration, after which you will be returned to Acunetix.
5. Log in to MuleSoft Anypoint Exchange with the account that contains your API specification files. Then click Grant access to… to authorize the integration.

Once complete, you will see a short message displayed in Invicti: Authorization was successful. Your MuleSoft integration now appears on the Sources page in Invicti. Continue with the final step below to synchronize the API import.

Step 3: Synchronize the API import

1. On the Discovery > Configuration > API  sources page, click the sync icon to start importing your API specification files from MuleSoft into your Acunetix API Inventory.

2. When the sync is complete, your API specification files will be displayed on the API catalog. From this page, you can link your API specification files to targets so they can be scanned for vulnerabilities. For more information, refer to Linking and unlinking discovered APIs to targets.

Your MuleSoft Anypoint Exchange account is now integrated with Invicti Platform. After the initial synchronization, the integration will automatically sync your API specifications once every 24 hours.