Checkmarx API Security
Checkmarx API Security discovers APIs in application code and documentation, including undocumented shadow APIs and abandoned zombie APIs.
What Checkmarx API Security is
Checkmarx API Security discovers APIs in application code and documentation, including undocumented shadow APIs and abandoned zombie APIs. It builds an inventory that pairs detected vulnerabilities with context for prioritizing remediation by business risk. The scanner supports Java Spring, ASP.NET Web API, and Python Flask, and can examine OpenAPI, Swagger, and Postman collections for differences from the inventory. Its API Change Log records API history, including the commit and developer linked to a change that introduced a vulnerability. For teams using Checkmarx DAST, runtime findings can be correlated with SAST findings in the unified inventory. Listed integrations include GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, GitHub Actions, VS Code, JetBrains, Jira, Slack, and Microsoft Teams. The product is paid, with custom quotes based on modules, deployment model, and number of developers in scope. There is no self-serve free trial; Checkmarx offers a personalized demo. Its product page says an AppSec expert responds to inquiries within one business day.
Good
- Finds undocumented and abandoned APIs
- Compares API documentation with inventory
- Tracks changes linked to commits and developers
- Correlates DAST and SAST findings
Watch out
- No self-serve free trial
- Pricing is custom quoted
- Scanner currently supports three frameworks
Who it suits
It suits application security teams that need API discovery, inventory, and vulnerability context across code and API documentation. Teams should check whether their frameworks are among the currently supported options.
Verdict
Checkmarx API Security combines API discovery with documentation comparison and vulnerability tracking. Its custom pricing and supported-framework list are important considerations for prospective teams.
Plans and prices
From Checkmarx API Security's own pricing page, checked 20 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Checkmarx One bundle | Priced on request | Custom quote · Pricing based on developers, apps and usage · Pricing is based on developers, apps, and usage. |
| Enterprise | Priced on request | Essentials and Professional plus IaC Security · secrets detection · Codebashing |
| Essentials | Priced on request | SAST · SCA · API Security · ASPM |
| Professional | Priced on request | Essentials plus malicious package protection · repository health · DAST · container security |
| Start with SAST | Priced on request | SAST · optional API Security · IaC Security · secrets detection · Checkmarx Assist · Codebashing · AI Inventory |
| Start with Supply Chain | Priced on request | SCA · malicious package protection · repository health · container security |
The facts
Each one read from Checkmarx API Security's own pages, with the date it was checked.
What it does
- API change history
- The API change log records endpoint history, commits, developers, and prior API states to help trace how risk was introduced.checked 21 Oct 2026
- API discovery
- Source-code scanning automatically discovers API endpoints, including undocumented shadow APIs and abandoned zombie APIs.checked 21 Oct 2026
- Audience
- Checkmarx describes Essentials as core application security for teams building their program, Professional as a scaling package, and Enterprise as coverage for organizations with demanding security requirements.checked 3 Oct 2026
- Change history
- The API Change Log shows API history, including the commit and developer associated with a change that introduced a vulnerability.checked 3 Oct 2026
- CI/CD and IDE plugins
- Documented plugins include GitHub Actions, Jenkins, TeamCity, Azure DevOps, Maven, VS Code, Visual Studio, JetBrains, and Eclipse.checked 21 Oct 2026
- CLI
- The standalone CLI mirrors REST API functionality for project management, scan control, and result display.checked 21 Oct 2026
- CLI operating systems
- Tested CLI environments include Windows 10/11 and Windows Server, Red Hat, Amazon Linux, Fedora, Ubuntu, CentOS, and macOS Sequoia.checked 21 Oct 2026
- Compliance
- The trust center states ISO/IEC 27001:2022 certification, annual independent SOC 2 Type II audits, GDPR alignment, and NIST SSDF alignment.checked 21 Oct 2026
- DAST correlation
- Native Checkmarx DAST integration combines static and dynamic findings in one API inventory and raises priority when runtime exploitation is confirmed.checked 21 Oct 2026
- DAST limitation
- DAST runs from Checkmarx One have a two-hour-45-minute timeout and uploaded result archives are limited to 150 MB.checked 21 Oct 2026
- DAST requirements
- DAST CLI guidance specifies 8–16 GB RAM, 3 GB RAM and 2 CPUs per worker, and Docker-capable Windows, macOS, or Linux.checked 21 Oct 2026
- Deployment
- Checkmarx pricing documentation says Checkmarx One is available as SaaS or self-hosted/on-premises, including air-gapped deployments.checked 21 Oct 2026
- Documentation scanning
- OpenAPI, Swagger, and Postman documentation can be scanned and compared with the discovered API inventory to expose discrepancies.checked 21 Oct 2026
- Global API inventory
- The product maintains an inventory of APIs and detected vulnerabilities so teams can prioritize remediation by business risk.checked 21 Oct 2026
- Integrations
- Checkmarx lists 41 integrations spanning SCM, CI/CD, IDEs, ticketing, registries, cloud, and infrastructure tools.checked 21 Oct 2026
- Inventory
- It provides a global API inventory with detected vulnerabilities and supports prioritizing remediation by business risk.checked 3 Oct 2026
- License model
- The 2026 license terms define Checkmarx One licensing around contributing developers and a 15-million-lines-scanned-per-license 90-day account limit.checked 21 Oct 2026
- Limit: Capterra reviewers
- Capterra reviewers mention false positives, slow scans, difficult configuration, limited user-friendliness, and unsupported languages such as ColdFusion and R.checked 21 Oct 2026
- Limit: G2 false positives
- G2 summarizes recurring complaints about many false positives complicating analysis, plus individual complaints about slow scans, confusing setup, and high cost.checked 21 Oct 2026
The company
- Company facts
- LinkedIn lists Checkmarx as privately held, founded in 2006, headquartered in Paramus, New Jersey, with 501–1,000 employees.checked 21 Oct 2026
- Company legal name
- Crunchbase identifies the legal entity as Checkmarx Ltd.checked 21 Oct 2026
- Founded
- 2006checked 28 Sep 2026
- Headquarters
- Ramat Gan, Israelchecked 28 Sep 2026
Where it runs
- Limit: GetApp reviewers
- GetApp review data shows value-for-money scoring of 3.0/5 and complaints about expense, slowness, messy reporting, installation difficulty, and downtime delays.checked 21 Oct 2026
Alternatives to Checkmarx API Security
- 1
42Crunch API Security Platform
Free planWebAPIExtensionLinux7.9From $9 a month - 2
APIPosture
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.8From $9 a month - 3
Onam Security API Security
Free planWebAPILinuxmacOS7.8From $22 a month - 4
APISec Platform
Free planWebAPIExtensionLinux7.5From $690 a month - 5
DataDome API Protection
AndroidiOSWebAPI6.8From $3,830 a month - 6
Haltdos
Free planWebAPILinuxSelf-hosted6.8From $30 a month