Skip to content

Selective Route Testing

By default, Mayhem will test every endpoint it finds in the provided spec.

If you need to filter down from this full set of endpoints, for example if:

  • you need to exclude a "logout" endpoint because it breaks all subsequent authenticated requests
  • you need to divide your spec into subsets with different authentication requirements
  • you want to incrementally add routes to mapi as the initial findings in each route are addressed

... or whatever other reason, the mapi command-line tool has you covered with a number of options.

Using OpenAPI Tags

If you already have an OpenAPI spec with tags at the right granularity to describe the subsets you want to filter on, you're in luck.

Use the --include-endpoints-by-tag <tag> option to specify that only endpoints with the given tag should be included (implicitly excluding all endpoints which don't have it.) If you specify multiple tags (by including the option more than once), they are logically "OR"ed together.

Use the --ignore-endpoints-by-tag <tag> option to specify that endpoints with the given tag should be explicitly excluded. If you specify multiple tags, they are logically "OR"ed together.

If you combine the two options, --include is applied first, followed by --ignore.

Using Endpoint Names

If you don't have tags at the right granularity, you can use powerful (but somewhat more complicated!) endpoint name matching to choose which endpoints to test.

ℹ️ This feature computes a unique "endpoint name" for each endpoint, which is just the HTTP verb and the path, joined with a space, like GET /ping or POST /users/{id}!

Use the --include-endpoint <pattern> option to specify that only endpoints whose computed name matches the given pattern should be included (implicitly excluding all endpoints which don't match it.) If you specify multiple patterns (by including the option more than once), they are logically "OR"ed together.

Use the --ignore-endpoint <pattern> option to specify that endpoints whose computed name matches the given pattern should be explicitly excluded. If you specify multiple patterns, they are logically "OR"ed together.

If you combine the two options, --include is applied first, followed by --ignore.

ℹ️ The "pattern" used to match endpoint names is a full-blown regular expression, if you need that kind of power.