Integrating MuleSoft Anypoint Exchange with Invicti Enterprise On-Demand

This feature is available with Invicti API Security Standalone or Bundle

Integrating Invicti Enterprise On-Demand with MuleSoft Anypoint Exchange allows you to fetch Swagger2, OpenAPI3, and RAML specification files from MuleSoft to build an inventory of API endpoints that can be scanned for vulnerabilities with our DAST scanners. The integration leverages Connected Apps, where Invicti Enterprise is the application that integrates via user account with MuleSoft Anypoint Exchange.

This document explains how to set up an integration between MuleSoft Anypoint Exchange and Invicti Enterprise On-Demand. If you are using Invicti Enterprise On-Premises, refer to Integrating MuleSoft Anypoint Exchange with Invicti Enterprise On-Premises.

How to integrate Invicti Enterprise On-Demand with MuleSoft Anypoint Exchange

This integration has three steps. Follow the steps below in each section to prepare your MuleSoft Anypoint Exchange account for integration with Invicti Enterprise On-Demand.

Step 1: Ensure you have a MuleSoft Anypoint Exchange account

In order for Invicti Enterprise to successfully fetch your Swagger2, OpenAPI3, and RAML specification files from MuleSoft, you need to have a Mulesoft Anypoint Exchange account that contains your API specification files. This account will be used to facilitate creating a Connected App integration between Invicti Enterprise and MuleSoft Anypoint Exchange, which will import and sync your API specifications.

The integration will use the Connected App to access the following filter scopes:

• Exchange Viewer 
• Profile 
• Background Access (this is necessary for the refresh token functionality)

Once you have a MuleSoft Anypoint Exchange account, continue with step 2 below to configure the API import source.

Step 2: Configure the API import source in Invicti Enterprise

Now that you have access to MuleSoft Anypoint Exchange, you are ready to set up the MuleSoft integration in Invicti Enterprise to import your API specification files.

1. Log in to Invicti Enterprise On-Demand.
2. Select APIs > Sources from the left-side menu.

3. Click Add new source.

4. Enter a name for the API integration and select MuleSoft as the source type.

5. Click Authenticate and Save. You will be directed to your MuleSoft account to authorize the integration, after which you will be returned to Invicti Enterprise.
6. Log in to MuleSoft Anypoint Exchange with the account that contains your API specification files.

7. Click Grant access to… to authorize the integration.

Once complete, you will see a short message displayed in Invicti Enterprise: Authorization was successful. Your MuleSoft integration now appears on the APIs > Sources page in Invicti Enterprise. Continue with the final step below to synchronize the API import.

Step 3: Synchronize the API import

1. On the APIs > Sources page in Invicti Enterprise, click the sync icon to start importing your API specification files from MuleSoft into your Invicti Enterprise API Inventory.

2. When the sync is complete, your API specification files will be displayed on the API Inventory page in Invicti Enterprise. From this page, you can link your API specification files to targets so they can be scanned for vulnerabilities. For more information, refer to Linking and unlinking discovered APIs to targets.

Your MuleSoft Anypoint Exchange account is now integrated with Invicti Enterprise. After the initial synchronization, the integration will automatically sync your API specifications once every 24 hours.