Getting started

Install Studio, create a project, and import your first API.

Studio is a desktop app, not a hosted scanner: everything in this section runs on your machine, against APIs you own, with no account required.

Install and launch

Download the installer for your OS from the Studio product page and run it. On first launch you land on the Project view — the app has nothing open yet, and nothing has left your machine.

The sidebar is grouped the same way this guide is:

  • Core — Project, Endpoints, Sitemap, Findings, Coverage
  • Traffic — Proxy, WebSocket, Repeater, Comparer, Decoder, Sequencer, Intruder
  • Auth & scope — Auth profiles, Role diff, Environments, Match & replace, Login macros
  • More — Checklist, Extender, Settings, AI coach

Create your first project

A Studio project is a single local SQLite file — endpoints, captured traffic, findings, auth profiles, and everything else you build up lives in that one file, next to your other projects on disk.

  1. Open the Project view.
  2. Give the project a name and the API's base URL (for example https://api.myapp.dev).
  3. Choose where to save the project file. Studio suggests a filename derived from the project name.
  4. To come back later, use Open project and pick the same .sqlite file — everything you captured is still there.

There's no sign-in step here. Accounts only come into play for the optional AI coach.

Bring in your API

With a project open, go to Endpoints and import what you already have. Studio merges every import into one inventory — method + path pairs are deduplicated, so you can layer an OpenAPI spec, a Postman collection, and a HAR capture on the same project without clobbering each other:

  • OpenAPI 3 (JSON or YAML)
  • Swagger 2.0 (best-effort conversion)
  • Postman collection (.json export)
  • HAR (.har, from your browser's DevTools network tab or another proxy)
  • GraphQL — point Studio at an introspection-enabled endpoint and it builds an inventory from the schema
  • Docker Compose — parses a docker-compose.yml and lists the HTTP services it finds, so you can seed a project straight from a local dev stack

No API spec handy? Turn on the proxy and drive traffic through the app or browser instead — every request the proxy sees is captured the same way an import would be.

Run a first pass

Once you have endpoints, open Findings and run a quick scan: Studio fetches every documented endpoint once, captures the exchange, and runs the default passive rule set over the responses — no proxy, no manual clicking required. It's the fastest way to see whether a spec is wired up correctly and to get an initial findings list.

From there: