Endpoints observed during login and crawling are assembled into a synthesized API spec, so the scan reaches routes an anonymous crawl would never find.
Getting a session is only half of reaching the authenticated surface. A scanner still has to know that surface exists, and a modern application does not advertise its API routes on a public page. Argus Pentest records the endpoints it sees while signing in and moving through the application, and assembles them into a synthesized specification that the scanner takes as its map.
Endpoints observed during the authenticated session are collected as they appear.
Those endpoints are assembled into a synthesized API spec.
The scanner works from that spec rather than from public links alone.
Routes reachable only after login come into scope.
No hand-maintained endpoint list to keep in step with the application.
No. The spec is synthesized from what the authenticated session actually observes, so it reflects the running application rather than documentation that may have drifted.
No. Discovery only ever runs inside a target you have already added to the allow-list; it finds more of that target, not more targets.
A scripted login hands the scanner real session cookies and a bearer token.
Scans run against an explicit allow-list — a target must be added deliberately.
The model generates payloads and triages results — text in, text out, never vision.
Credentials, scan traffic and reports all stay on your own infrastructure.
See the complete product: problem, features, how it works and deployment.
Request a demo to watch a scan log in to an approved target and work the surface behind the sign-in form.