openapi: 3.1.0
info:
  title: Astra Pentest API
  version: '2026-10-18'
  description: 'GENERATED FROM DOCUMENTATION by API Evangelist on 2026-10-18: 12 operation(s) read from 7 public documentation page(s) (each operation
    names its page in x-source). This is not the provider''s published contract; Astra Pentest has published no machine-readable contract that
    the pipeline could find. Engine: local.'
  x-evidence-tiers:
    code-example: 7
    documentation: 5
    pages-with-code: 6
    pages-read: 7
  x-generated-from: documentation
  x-provenance: generated
  x-authored-by: API Evangelist
  x-generated: '2026-10-18'
  x-generator: generate-contract-from-docs.py
  x-engine: local
  x-sources:
  - https://help.getastra.com/articles/3497171462-how-to-mitigate-the-risks-for-api-endpoints
  - https://help.getastra.com/articles/2219221748-troubleshooting-api-endpoints-not-visible-in-astra-dashboard-after-sending-requests-via-proxy
  - https://help.getastra.com/articles/1931275022-api-target-setup
  - https://help.getastra.com/articles/1003530399-how-to-setup-astra-proxy-service-integration
  - https://help.getastra.com/articles/2789053606-how-to-scan-applications-with-restricted-access
  - https://help.getastra.com/articles/5046189569-how-to-setup-http-requests-tracing-using-opentelemetry-sdk
  - https://help.getastra.com/articles/1003530399
paths:
  /:
    get:
      operationId: get
      tags:
      - Api
      summary: GET /
      x-source: https://help.getastra.com/articles/1003530399-how-to-setup-astra-proxy-service-integration
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl. Using astra-cli , you can deploy both the Astra Proxy Service, a Dockerized MITM forward proxy, and the Astra Traffic
          Collector, an OpenTelemetry (OTel)-based collector. Together, these components capture, process, and forward API traffic for observability
          and inventory creation. The traffic flow works as follows: Client applications are configured to use Astra Proxy Service as a forward
          pro'
  /data:
    post:
      operationId: post_data
      tags:
      - Data
      summary: POST /data
      x-source: https://help.getastra.com/articles/1931275022-api-target-setup
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl -v -H "Authorization: Bearer <JWT_TOKEN>" \ -X POST https://api.example.com/data API Key Inputs: Header Name (e.g. x-api-key
          ), Header Value (e.g. abc123 ) bash'
  /data-sync-service:
    post:
      operationId: post_data_sync_service
      tags:
      - Data Sync Service
      summary: Example POST https://internal.example.com/data-sync-service
      x-source: https://help.getastra.com/articles/3497171462-how-to-mitigate-the-risks-for-api-endpoints
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /resource:
    post:
      operationId: post_resource
      tags:
      - Resource
      summary: POST /resource
      x-source: https://help.getastra.com/articles/1931275022-api-target-setup
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl -v -H "Authorization: Bearer YOUR_TOKEN_HERE" \ -X POST https://api.example.com/resource JWT Bearer Inputs: Algorithm (HS256
          or RS256), Secret (base64 encoded), JWT Payload & Header , Header Prefix , Header Name bash'
  /secure:
    post:
      operationId: post_secure
      tags:
      - Secure
      summary: POST /secure
      x-source: https://help.getastra.com/articles/1931275022-api-target-setup
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl -v -H "x-api-key: abc123" \ -X POST https://api.example.com/secure Step 7: Improve Coverage Providing context about your
          application helps Astra improve scan accuracy and assists security engineers during manual testing. Additional Hosts Add up to 5 hosts
          to include in the scan scope. Custom HTTP headers Add custom headers that will be attached to every scanner request. Useful for: Cloud
          API '
  /token:
    post:
      operationId: post_token
      tags:
      - Token
      summary: POST /token
      x-source: https://help.getastra.com/articles/1931275022-api-target-setup
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl -v -X POST https://auth.example.com/token  -d "grant_type=client_credentials"  -d "client_id=abc123"  -d "client_secret=xyz789"
          OAuth 2.0 Password Credentials Grant Inputs: Access Token URL , Client ID , Client Secret , Username , Password curl -v -X POST https://auth.example.com/token  -d
          "grant_type=password"  -d "client_id=abc123"  -d "client_secret=xyz789"  -d "username=john"  -d "passwor'
  /users:
    post:
      operationId: post_users
      tags:
      - Users
      summary: POST /users
      x-source: https://help.getastra.com/articles/5046189569-how-to-setup-http-requests-tracing-using-opentelemetry-sdk
      parameters:
      - name: source
        in: query
        required: false
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostUsersRequest'
      responses:
        '201':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostUsersResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl request and how that request is mapped to otel span attributes for easy understanding HTTP Request cURL: curl -X POST 'https://api.example.com/users?source=mobile'\
          \  -H 'Content-Type: application/json'  -H 'Accept: application/json'  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'\
          \  -H 'User-Agent: MyApp/1.0'  --data-raw '{\n \"name\": \"John Doe\",\n \"email\": \"john.doe@example.com"
  /v1:
    get:
      operationId: get_v1
      tags:
      - Api
      summary: GET /v1
      x-source: https://help.getastra.com/articles/2219221748-troubleshooting-api-endpoints-not-visible-in-astra-dashboard-after-sending-requests-via-proxy
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: curl) to send requests through the Astra Proxy Service, but no API endpoints are appearing in the Astra dashboard or inventory.
          Common Causes and Fixes Requests are not returning 2XX or 3XX status codes Astra Proxy only captures traffic that results in a successful
          response. Requests returning 4XX or 5XX errors are not logged. Check the response status code in your API client and ensure requests
          a
  /v1/old-customer-orders:
    get:
      operationId: get_v1_old_customer_orders
      tags:
      - Old Customer Orders
      summary: Example GET https://api.example.com/v1/old-customer-orders
      x-source: https://help.getastra.com/articles/3497171462-how-to-mitigate-the-risks-for-api-endpoints
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v1/user-login:
    get:
      operationId: get_v1_user_login
      tags:
      - User Login
      summary: Example GET https://api.example.com/v1/user-login
      x-source: https://help.getastra.com/articles/3497171462-how-to-mitigate-the-risks-for-api-endpoints
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v1/user-profile:
    get:
      operationId: get_v1_user_profile
      tags:
      - User Profile
      summary: Example GET https://api.example.com/v1/user-profile?userId=123
      x-source: https://help.getastra.com/articles/3497171462-how-to-mitigate-the-risks-for-api-endpoints
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v2/remove-user-account:
    delete:
      operationId: delete_v2_remove_user_account
      tags:
      - Remove User Account
      summary: Example DELETE https://api.example.com/v2/remove-user-account
      x-source: https://help.getastra.com/articles/3497171462-how-to-mitigate-the-risks-for-api-endpoints
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
components:
  schemas:
    PostUsersRequest:
      type: object
      properties:
        name:
          type: string
        email:
          type: string
        age:
          type: integer
        preferences:
          type: object
          properties:
            theme:
              type: string
            notifications:
              type: boolean
    PostUsersResponse:
      type: object
      properties:
        id:
          type: integer
        name:
          type: string
        email:
          type: string
        created_at:
          type: string
          format: date-time
        status:
          type: string
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
security:
- bearer: []
tags:
- name: Api
- name: Data
- name: Data Sync Service
- name: Old Customer Orders
- name: Remove User Account
- name: Resource
- name: Secure
- name: Token
- name: User Login
- name: User Profile
- name: Users