- Home
- API Security Software
- Checkmarx API Security
Checkmarx API Security
Ramat Gan, Israel
What it is
Checkmarx API Security discovers APIs in application code and documentation, including undocumented shadow APIs and abandoned zombie APIs. It builds a global inventory of APIs and detected vulnerabilities to help teams prioritize remediation by business risk. The scanner supports Java Spring, ASP.NET Web API, and Python Flask. It can scan OpenAPI, Swagger, and Postman collections and compare them with the inventory to find discrepancies or undocumented APIs. The API Change Log tracks history, including the commit and developer linked to a change that introduced a vulnerability. Teams using Checkmarx DAST can correlate runtime findings with SAST findings in the unified inventory. Listed integrations include GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, GitHub Actions, VS Code, JetBrains, Jira, Slack, and Microsoft Teams. Checkmarx says customer data is encrypted at rest and service communications use HTTPS with TLS 1.2 for data to and from Amazon S3. Pricing is custom quoted based on modules, deployment model, and developer count. There is no self-serve free trial; Checkmarx offers a personalized demo.
For and against
For
- Finds undocumented and abandoned APIs.
- Compares API documentation with the inventory.
- Tracks commits associated with vulnerability-introducing changes.
- Integrates with code hosts and development tools.
Against
- No self-serve free trial is offered.
- Pricing is custom and not listed.
- Scanner support is listed for three frameworks.
The verdict
Checkmarx API Security combines API discovery, documentation comparison, and change history for security review. Teams should confirm that its supported frameworks and custom-quoted plan fit their environment.
Who it suits
Checkmarx API Security is for application security teams that need API discovery, inventory, and vulnerability prioritization. The maker describes Essentials for teams building a program, Professional for scaling, and Enterprise for demanding security requirements.
Plans and prices
Checkmarx One bundle
Custom quote · Pricing based on developers, apps and usage
Read 20 Sep 2026 · checkmarx.com
Enterprise
Essentials and Professional plus IaC Security · secrets detection · Codebashing
Read 21 Oct 2026 · checkmarx.com
Essentials
SAST · SCA · API Security · ASPM
Read 21 Oct 2026 · checkmarx.com
Professional
Essentials plus malicious package protection · repository health · DAST · container security
Read 21 Oct 2026 · checkmarx.com
Start with SAST
SAST · optional API Security · IaC Security · secrets detection
Read 21 Oct 2026 · checkmarx.com
Start with Supply Chain
SCA · malicious package protection · repository health · container security
Read 21 Oct 2026 · checkmarx.com
On the record
- API change history
- The API change log records endpoint history, commits, developers, and prior API states to help trace how risk was introduced.checkmarx.com · read 21 Oct 2026
- API discovery
- Source-code scanning automatically discovers API endpoints, including undocumented shadow APIs and abandoned zombie APIs.docs.checkmarx.com · read 21 Oct 2026
- Audience
- Checkmarx describes Essentials as core application security for teams building their program, Professional as a scaling package, and Enterprise as coverage for organizations with demanding security requirements.checkmarx.com · read 3 Oct 2026
- Change history
- The API Change Log shows API history, including the commit and developer associated with a change that introduced a vulnerability.checkmarx.com · read 3 Oct 2026
- CI/CD and IDE plugins
- Documented plugins include GitHub Actions, Jenkins, TeamCity, Azure DevOps, Maven, VS Code, Visual Studio, JetBrains, and Eclipse.docs.checkmarx.com · read 21 Oct 2026
- CLI
- The standalone CLI mirrors REST API functionality for project management, scan control, and result display.docs.checkmarx.com · read 21 Oct 2026
- CLI operating systems
- Tested CLI environments include Windows 10/11 and Windows Server, Red Hat, Amazon Linux, Fedora, Ubuntu, CentOS, and macOS Sequoia.docs.checkmarx.com · read 21 Oct 2026
- Company facts
- LinkedIn lists Checkmarx as privately held, founded in 2006, headquartered in Paramus, New Jersey, with 501–1,000 employees.linkedin.com · read 21 Oct 2026
- Company legal name
- Crunchbase identifies the legal entity as Checkmarx Ltd.crunchbase.com · read 21 Oct 2026
- Compliance
- The trust center states ISO/IEC 27001:2022 certification, annual independent SOC 2 Type II audits, GDPR alignment, and NIST SSDF alignment.checkmarx.com · read 21 Oct 2026
- DAST correlation
- Native Checkmarx DAST integration combines static and dynamic findings in one API inventory and raises priority when runtime exploitation is confirmed.checkmarx.com · read 21 Oct 2026
- DAST limitation
- DAST runs from Checkmarx One have a two-hour-45-minute timeout and uploaded result archives are limited to 150 MB.docs.checkmarx.com · read 21 Oct 2026
- DAST requirements
- DAST CLI guidance specifies 8–16 GB RAM, 3 GB RAM and 2 CPUs per worker, and Docker-capable Windows, macOS, or Linux.docs.checkmarx.com · read 21 Oct 2026
- Deployment
- Checkmarx pricing documentation says Checkmarx One is available as SaaS or self-hosted/on-premises, including air-gapped deployments.checkmarx.com · read 21 Oct 2026
- Documentation scanning
- OpenAPI, Swagger, and Postman documentation can be scanned and compared with the discovered API inventory to expose discrepancies.checkmarx.com · read 21 Oct 2026
- Global API inventory
- The product maintains an inventory of APIs and detected vulnerabilities so teams can prioritize remediation by business risk.checkmarx.com · read 21 Oct 2026
- Integrations
- Checkmarx lists 41 integrations spanning SCM, CI/CD, IDEs, ticketing, registries, cloud, and infrastructure tools.checkmarx.com · read 21 Oct 2026
- Inventory
- It provides a global API inventory with detected vulnerabilities and supports prioritizing remediation by business risk.checkmarx.com · read 3 Oct 2026
