Snyk API & Web (formerly Probely)

Snyk API & Web is a cloud-based dynamic application security testing (DAST) product that finds vulnerabilities in running web applications and APIs by simulating attacks against deployed systems. It is the former Probely product, which Snyk acquired in 2024. The service's API endpoints, web console, and some tool names still use the legacy Probely name.

Key Capabilities

• Web application scanning: The scanner crawls an application, discovers pages and functionality, interacts with forms and buttons, and runs security tests across what it finds. Targets can be guided with seeds and reject lists, navigation sequences, a sequence recorder, and extra hosts.
• API scanning: The scanner tests all endpoints defined in an API schema. Supported schema formats are OpenAPI, Postman Collection, GraphQL, RAML, and Bruno Collection, and the documentation also covers configuring an API target without a schema file. API targets can use signed requests and message-level encryption.
• Scan profiles: There are four built-in profiles, plus custom profiles. Lightning checks Secure Sockets Layer / Transport Layer Security (SSL/TLS), HTTP header, and cookie issues, and is meant to finish in under a minute. Safe tests all supported vulnerabilities with a limited payload set and GET requests only. Normal uses a broader payload set with no method restrictions. Full adds an even larger payload set to Normal.
• Authentication handling: Supported methods are Basic, login forms, recorded login sequences, two-factor authentication (including time-based one-time password (TOTP) apps and email or SMS codes), OpenAPI, Postman, and GraphQL authentication, mutual TLS, and NTLM. The scanner also handles logout detection with automatic re-authentication. It can be set to fail the scan if authentication fails.
• Internal and private targets: A scanning agent, deployed as a Docker container or Kubernetes workload, creates a secure tunnel between Snyk's cloud and a private network. This covers development and staging environments, internal tools, and applications behind firewalls or VPNs. For public targets, ownership is verified through a TXT file, a DNS TXT or CNAME record, or a meta tag.
• Vulnerability coverage: The documentation lists 136 current vulnerability types, 54 of them vulnerable client-side JavaScript libraries. The rest include SQL injection, cross-site scripting (XSS), OS command injection, XML external entity (XXE) injection, server-side request forgery (SSRF), path traversal, broken object level authorization (BOLA), TLS and certificate weaknesses, missing or weak security headers, JSON Web Token (JWT) flaws, information disclosure, and framework misconfiguration. Scans can be run against the 2021 and 2025 OWASP Top 10, and an OWASP Top 10 report is available. All built-in profiles check the Top 10 except Lightning.
• Asset discovery: The product finds web applications and APIs from a domain, or from Cloudflare, AWS, or Akamai connections. It queries the cloud providers, searches Certificate Transparency logs, and guesses likely domains. It then resolves them to IP addresses, scans for open services, takes screenshots, and runs a Security Headers check to produce a score. Discovered assets can be added as scan targets.
• Scan management: Scans can be scheduled, run in bulk, paused, or run partially. Custom headers, a risk acceptance workflow, and documentation for configuring WAF allowlists and identifying scanner requests are also provided.
• Findings and reporting: Findings carry severity ratings with Common Vulnerability Scoring System (CVSS) scores, affected endpoints, remediation guidance, and evidence of exploitability. Findings have states (including invalid and false positive), can be assigned to team members, and are reported through scan reports, coverage reports, saved reports, and CSV export.
• Snyk Code correlation: For targets that Snyk Code (static application security testing) also scans, the integration correlates DAST findings with source-code findings. A correlated finding shows a link to the vulnerability in Snyk Code, a link to the repository, and a code snippet.
• Integrations: CI/CD support covers GitHub Actions, Jenkins, GitLab CI/CD, and Bitbucket Pipelines, and builds can fail on vulnerability thresholds. Issue tracking supports Jira Cloud and Server, Azure DevOps Boards, ServiceNow, and Shortcut. Other integrations are Slack and DefectDojo. A REST API, a command-line interface (CLI), and API keys support automation.
• Account administration: Single sign-on (SSO), two-factor authentication (including enforcement), roles and permissions, teams, audit log reports, and custom CA certificates are documented.
• AI-assisted scanning: Snyk states that the crawler and scanner use proprietary and third-party large language models (LLMs) to analyze portions of HTTP requests and responses in real time. The setting is on by default for trials and paid accounts and off by default for free accounts.

Audience & Use Cases

• Audience: Application security teams, DevOps and platform engineers, and developers responsible for web applications and APIs.
• Use Case: Scanning applications and APIs in CI/CD pipelines after deployment, with build failures on severity thresholds.
• Use Case: Scanning authenticated parts of an application, including APIs behind token, mutual TLS, or multi-step login flows.
• Use Case: Scanning internal and staging applications that are not exposed to the internet.
• Use Case: Finding unmanaged or forgotten web applications and APIs through asset discovery.
• Use Case: Producing OWASP Top 10 and coverage reports for an application.