The Application Model is how apisec learns your application. Endpoints, identities, roles, object ownership, and the business logic that connects them, built dynamically by interacting with the running application. Every attack apisec generates comes from it. Every exploit apisec proves is validated against it. Without the model, you have a scanner. With it, you have an attacker.
No documentation required. No developer interviews required.
What used to live in a developer's head, written down, kept current, and readable by anyone on the team.
Point a generic tool at your application and it sends traffic at endpoints. It has no idea which user is supposed to own which object, which role is allowed to call which function, or which two calls were never meant to touch each other. So it tests what is generic and reports what is possible.
The exploits that actually hurt are not generic. Broken object-level authorization, broken function-level authorization, tenant isolation failures, business logic abuse. Every one of those is a statement about your application specifically. You cannot test for them without knowing how your application is supposed to behave.
That knowledge used to belong to one person. A senior offensive engineer who spent days clicking through the application, reading stale documentation, and working out the roles and the ownership rules, until they held the whole thing in their head. Then they moved on, and it left with them.
Context is the difference between an attack and a guess.
Discovery tells apisec what exists. The model is how apisec understands it. Each agent below writes into the same structure, and each one reads what the others have already established.
Works out how the application authenticates and who it thinks you are. Bearer tokens, custom auth, HMAC, API keys, certificates, username and password, OAuth, mTLS, and SSO, including multi-step chains. This is what lets every later test run as a genuinely authenticated user instead of stopping at the login boundary.
Derives the sequences the application actually supports. Which call has to happen before which, what state a request depends on, and where a workflow can be entered out of order.
Generates realistic parameter values and chains them across calls. A test that sends a made-up ID into an endpoint is a test that did not run. Hydration is what turns a request into a real one.
Infers what an endpoint is for, not just what it accepts. Purpose is what makes it possible to ask whether a caller should be able to do something, rather than only whether they can.
Reconciles what the discovery sources say. A gateway, a repo, a Postman collection, and live traffic will each describe the same application slightly differently. Fusion resolves them into one surface.
Fills the gaps between observations. Spans, relationships, and ownership rules that were never documented anywhere but are visible in the way the application behaves.
Discovery feeds the model. Identity, business flow, and hydration are its foundation. The exploit loop continuously validates against it.
The model is not a deliverable. It is the input to the part that matters. apisec takes attack categories built by researchers who breach applications for a living, applies them to your specific model, and executes.
Workflow and state abuse. Legitimate requests, sequenced to cause harm.
Injection, SSRF, token manipulation, misconfiguration, data exposure, and the rest of the classics, aimed by the model rather than sprayed.
Runs the attempt against the deployed application and captures the outcome. Proof comes by execution, not by inference.
Separates what ran from what did not, and ranks what is left by what an attacker actually reached.
Continuous loop. As the application changes, the model changes, and the tests change with it.
That ratio is not a volume claim. It is what happens when tests are derived from a real understanding of the application rather than a fixed rule list. Every role against every object. Every function against every privilege boundary. Every workflow entered from the wrong step.
Nobody writes 6,300 tests by hand. Nobody maintains them as the application changes weekly. The model does both, because the tests are a function of the model rather than a library sitting next to it.
BOLA scenarios are generated with owner and attacker roles automatically. That is the test class most teams write by hand, and the one they stop maintaining first.
Probabilistic tools return different findings on the same application from one run to the next. That is the open problem in this category and the reason the output is so hard to govern.
apisec uses models to reason about your application and to generate attacks. It does not use a model to decide whether an attack worked. Execution is the arbiter. Deterministic, repeatable, replayable, auditable.
We automated the judgment. We did not automate the verdict.
A living, canonical representation of how your application works, built by interacting with it systematically, kept current as it changes, and used to generate and validate attacks specific to it.
Not a spec. Not a catalog. Not a diagram somebody drew once. An inventory tells you what exists. The model tells you how it behaves, which is the only thing that makes exploitability a question you can answer.
apisec discovers applications and their APIs across infrastructure, source, gateways, ingress and auth paths, web apps, Postman, SwaggerHub, Insomnia, and CI/CD, including agents, MCP servers, and LLM call sites.
If you want to see your own surface first, the free Surface tools produce exactly what the model consumes:
Point apisec at it with an OpenAPI spec or a set of endpoints, an environment, and a credential. The model builds itself from there.
Outside-in proof of what an attacker reaches, paired with inside-out code location for the fix. The model is what connects them.
The mental model a senior engineer builds over days is the same thing apisec builds automatically. The difference is that this one is written down, updated continuously, and readable by the whole team.
AI now sits on both sides of application security. Attackers can read a codebase, chain low-severity bugs into a working exploit, and run continuously. Finding is no longer the advantage. Understanding your specific application, its real authorization model, and its live data flows is the defender's home-field advantage, and the Application Model is how apisec holds it.