API definition declares webhooks but no paths

Issue ID: v3_1-warning-paths-missing-with-webhooks

Description

The API definition defines webhooks, but it has no paths defined. While the OpenAPI Specification (OAS) allows this, it may not be what you want.

If an API definition does not define any paths, it does not expose any API endpoints. 42crunch API Scan requires API endpoints to which it can send test requests and analyze the received API response.

Webhooks work the opposite way: they send data when a predetermined event happens, not as a response to a particular request. Therefore, if the API does not expose an endpoint, it cannot be scanned, because API Scan cannot work with webhooks.

For more details, see the OpenAPI Specification.

Remediation

If you want to scan your API with API Scan, define paths in addition to webhooks .