API Quickstart

This guide follows the current NAT Cloud scan contract: authenticate with your NAT API key, upload an OpenAPI/Swagger or Postman specification, provide the target API base URL, then poll for status and retrieve results.

Prefer to run NAT locally? See the CLI Quickstart. The local CLI does not require a NAT Cloud API key.

Base URL

https://api.nat-testing.io/api/v1

Sign up

Create an account at app.nat-testing.io/signup (opens in a new tab).

Get your NAT Cloud API key

In the dashboard, open Settings → API Keys and generate a key. NAT Cloud keys use the nat_pk_... format.

Store it securely and export it for the examples below:

export NAT_API_KEY="nat_pk_your_api_key_here"

Prepare your API specification

The scan endpoint currently accepts a specification upload. Save your OpenAPI/Swagger document or Postman collection locally, for example:

openapi.yaml

You will also need the base URL of the API under test, for example https://api.example.com.

Start your first scan

POST /api/v1/scan uses multipart/form-data with spec_file and base_url.

curl -X POST https://api.nat-testing.io/api/v1/scan \
  -H "X-API-Key: $NAT_API_KEY" \
  -F "spec_file=@openapi.yaml" \
  -F "base_url=https://api.example.com"

A successful 202 Accepted response contains the scan identifier, current status, and a message. Save the scan_id for subsequent requests.

Poll scan status

Use the canonical scan resource:

curl "https://api.nat-testing.io/api/v1/scan/$SCAN_ID" \
  -H "X-API-Key: $NAT_API_KEY"

Poll until the returned status reaches a terminal state such as completed, failed, or cancelled.

Fetch results

After completion:

curl "https://api.nat-testing.io/api/v1/scan/$SCAN_ID/results" \
  -H "X-API-Key: $NAT_API_KEY"

The results endpoint returns the stored scan results for the authenticated tenant.

Optional scan fields

The current scan endpoint also supports form fields including:

format (openapi or postman)
max_tests
auth_token
api_key and api_key_header for the system under test
use_llm, llm_provider, llm_model, and llm_api_key
webhook configuration

These are optional. Keep the first run minimal and add them only when needed.

For a Postman collection, include:

-F "format=postman"

Important authentication distinction

X-API-Key: $NAT_API_KEY authenticates you to NAT Cloud.

The optional auth_token, api_key, and api_key_header form fields configure authentication to the API you are testing. Do not confuse the two credential scopes.

Next steps

If a copied example elsewhere conflicts with this guide, the canonical runtime contract takes precedence. The scan creation route currently requires spec_file and base_url as multipart form fields.

Was this helpful?

Setup Wizard Functional Testing Quickstart