How to import OpenApi/Swagger API Specification into ZAP

In this blog post, we will show you how to import Open API specification into Zap.

Prerequisites:

Download of https://github.com/swagger-api/swagger-petstore into local folder.
ZAP 2.9 (with OpenAPI Support addon installed from Marketplace)

Petstore Setup

For this example, we will be using the Swagger Petstore.

And before we import the open api/swagger specification, we will need to start up the petstore. Instructions to do so is found in the github link in prerequisites. We will not be using the docker build way but start up the petstore using the command line. We are using Windows as the OS but it will work the same in other environments. When you are at the command prompt, go to where the petstore source code was downloaded into, at the base of the project directory and run the command mvn package jetty:run

If you encounter errors with dependencies, you might want to replace the dependencies in the pom.xml file with the code snippet below. They work at the time of writing this blog post.

    <properties>
        <maven-plugin-version>1.0.0</maven-plugin-version>
        <swagger-parser-version>2.0.19</swagger-parser-version>
        <swagger-core-version>2.1.2</swagger-core-version>
        <jackson-version>2.10.3</jackson-version>
        <swagger-inflector-version>2.0.5</swagger-inflector-version>
        <jetty-version>9.4.9.v20180320</jetty-version>
        <logback-version>1.0.1</logback-version>
        <junit-version>4.8.2</junit-version>
        <slf4j-version>1.6.3</slf4j-version>
    </properties>

Once you have gotten the petstore to run, check that you can access http://localhost:8080/api/v3/openapi.json in the browser.

Importing the OpenAPI Definition

Once that is done, launch ZAP and import the openapi.json link using the option below.

When the dialog box opens, copy the link below from https://github.com/swagger-api/swagger-petstore

and put it in the URL Pointing to OpenAPI defn field of the dialog box. Also, put in http://localhost:8080 into the Target URL field. This tells ZAP what the base url is of the api as it will be scanning it once the import is successful. Click on the “Import” button to import the api specification.

Alternatively, what you can do is to also download the yaml file that contains the api specification from https://github.com/swagger-api/swagger-petstore