Every assessment starts with the same question: how does the scanner actually know what to test? A single URL is enough for a simple app, but real API surfaces usually already exist somewhere else first — in a Postman collection, an OpenAPI contract, a captured Burp exchange, or a script full of curl commands nobody wants to retype. Ingest is where all of those become a scannable target, without forcing you to rebuild anything by hand.
Six formats, one destination. Whatever you paste in, it lands in the same scan corpus and goes through the same evidence pipeline.
The six formats, and when each one wins
URL is the simplest case: one approved endpoint or application base URL, typed directly. Use it when the authorized scope is a single host and you don't need anything more structured.
URL list is the same idea at scale — a newline-separated set of routes you've already confirmed are in scope. If someone handed you a spreadsheet of "these 40 endpoints are approved," this is where it goes.
cURL preserves something the other formats can lose by default: the exact method, headers, and body of a request that actually worked. If you have a representative call saved from testing — auth header, content type, real-shaped payload — pasting the raw curl command keeps all of that intact instead of asking you to reconstruct it field by field.
Burp request/response takes it a step further: a full captured exchange, request and response, sanitized of anything sensitive first. This is the clearest starting point when you already have a proxy history and just need one solid example to seed discovery from.
OpenAPI (or Swagger) turns a maintained API contract into operation-level coverage automatically — every path, method, and parameter the spec declares, without hand-entering a single one. Ingest reviews the detected servers, operations, parameters, content types, and authentication schemes before anything runs, so you can strip an environment you don't want in scope before it becomes a target.
Postman does the same for a maintained collection — requests and environments a team already keeps up to date, imported instead of duplicated.
What ingest does not do
Importing a definition never silently grows your scope. Every server URL an OpenAPI spec or Postman environment declares still has to be explicitly selected — a staging contract that happens to also list a production server doesn't put that production host in play just because it was in the file.
The same discipline applies to what's inside the import. Collections and specs accumulate things over time that shouldn't travel into a live assessment: leftover example tokens, webhook destinations pointing at real systems, admin routes nobody meant to expose. Review what got pulled in before launching — ingest surfaces it, it doesn't sanitize it for you.
From ingest to evidence
Once a target is ingested, it flows into the same scan launch wizard as any other assessment — Target, Modules, Authentication, Review — and the same Findings and HTTP Records evidence trail applies afterward. Ingest changes how you describe the target. It doesn't change how the result gets proven.
For the full reference on choosing a format, authentication configuration, and reviewing API-specific evidence, see API security testing in the docs.