The Import traffic item opens the Ingest page, which imports HTTP traffic or API specifications into project records. Its six input formats are HAR, OpenAPI, Postman, curl, URL list, and Raw request.
Which formats can you import?
HAR accepts a browser DevTools or proxy export.
OpenAPI accepts an OpenAPI 3 or Swagger 2 specification and seeds one record per operation.
Postman accepts a Postman collection v2 export.
curl accepts one or more curl commands.
URL list accepts one URL per line.
Raw request accepts an HTTP request copied from Burp Repeater.
How do imported inputs affect project scope?
Review the hosts in imported specifications and traffic before import. Keep the data within the project’s authorization and remove sensitive values.
If an input has no captured response and server-side response fetching is enabled, the server may send a network request. Project scope and active authorization checks still apply.
How do imported inputs relate to an assessment?
Imported data becomes project records. To assess a live API endpoint, use Assessment setup and select API endpoint. Its Scope step requires an existing reviewed authorization and included scope. Saving the setup does not start a scan.
For help with API targets, see API targets.