Supported Languages and Frameworks for API Discovery

NightVision API Discovery performs static analysis of API source code, leveraging common usage patterns of supported frameworks to generate OpenAPI documentation.

Customizations that extend or override framework routing behavior may prevent accurate OpenAPI generation. For best results, ensure that source code scanning includes all necessary libraries, submodules and plugins in addition to the root repository.

Supported Languages & Frameworks

Authentication and security schemes

Beyond routes, parameters, and responses, API Discovery reads the authentication and authorization guards on each endpoint and records them in the generated OpenAPI document:

Detected guards become components.securitySchemes entries plus a per-operation security requirement. Recognized guards map to the standard OpenAPI scheme types: HTTP bearer (JWT), HTTP basic, HTTP digest, apiKey (in a header, query parameter, or cookie), and oauth2 / openIdConnect.
Authorization role or scope names a guard requires are emitted on the operation as the x-roles extension. For oauth2 and openIdConnect schemes, where OpenAPI allows it, scopes are carried in the requirement’s scope list directly instead.
When a route’s security posture is derived heuristically (for example from a hand-rolled middleware’s behavior, a naming convention, or an assumed framework default) rather than entirely from documented framework semantics, the operation is flagged with the x-unsound: ["security"] extension so consumers can treat it as an approximation. The same marker is applied when stacked guards are modeled as alternatives (OR) whose exact combination cannot be determined statically.

The per-language pages below list the specific frameworks, libraries, and guards recognized for each language.

Other extensions

API Discovery adds two further extensions to the generated document:

Every operation carries x-source: <file>~~<line>, the source file and line where the route was discovered. This is what links findings back to the exact source location.
For PHP/Laravel, operations may also carry x-nv-dast-sinks, an array naming the dangerous sink classes reachable on that route (for example sql-injection, os-command, ssrf, open-redirect, ssti, file-upload). It reflects reachability of a sink API on the route, not a proven vulnerability, and is used to focus dynamic testing on the routes most worth attacking. See PHP frameworks.

If a framework that you use is not listed, please contact our support team at support@nightviz.ai.