CCloud Releases
Home
Following

Cloud Releases

Service catalogues and updates come from each provider's public product listing and announcements.

Explore

  • Home
  • Latest updates
  • Following

About

  • About
  • Contact
  • Privacy Policy
  • Terms of Use

Providers

  • Amazon Web Services
  • Microsoft Azure
  • Google Cloud
  • Cloudflare

Not affiliated with any cloud provider. Product names and logos belong to their owners.

  1. Providers
  2. ›Cloudflare
  3. ›API Shield
  4. ›Update

Feature•Mar 9, 2026

New Vulnerability Scanner for API Shield

API ShieldCloudflare · Application security

Introducing Cloudflare's Web and API Vulnerability Scanner (Open Beta)

Cloudflare is launching the Open Beta of the Web and API Vulnerability Scanner for all API Shield customers. This new, stateful Dynamic Application Security Testing (DAST) platform helps teams proactively find logic flaws in their APIs.

The initial release focuses on detecting Broken Object Level Authorization (BOLA) vulnerabilities by building API call graphs to simulate attacker and owner contexts, then testing these contexts by sending real HTTP requests to your APIs.

The scanner is now available via the Cloudflare API. To scan, set up your target environment, owner and attacker credentials, and upload your OpenAPI file with response schemas. The scanner will be available in the Cloudflare dashboard in a future release.

Access: This feature is only available to API Shield subscribers via the Cloudflare API. We hope you will use the API for programmatic integration into your CI/CD pipelines and security dashboards.

Documentation: Refer to the developer documentation to start scanning your endpoints today.

Read the original announcement↗

More from API Shield

All API Shield updates →

  1. Run schema learning on demand

    You can now manually request an API Shield schema learning run without waiting for the weekly schedule. Use this during testing after sending representative traffic to your API.

    API Shield•Feature•Oct 12, 2026

  2. Increased limits for JWT validation configurations

    API Shield JSON Web Token validation now supports 32 token configurations per zone by default. Each token configuration can contain up to 16 keys.

    API Shield•Feature•Aug 27, 2026

  3. Symmetric key support for JWT validation

    API Shield JSON Web Token validation now supports symmetric keys that use the HS256, HS384, and HS512 algorithms. You can configure HMAC verification keys in the Cloudflare dashboard or with the Cloudflare API.

    API Shield•Feature•Aug 25, 2026

  4. Web Assets fields now available in GraphQL Analytics API

    Two new fields are now available in the httpRequestsAdaptive and httpRequestsAdaptiveGroups GraphQL Analytics API datasets:

    API Shield•Feature•Mar 23, 2026