Burp history import is a workflow that uses captured traffic exported from Burp Suite to create or enrich an API service definition. It helps teams assess undocumented or fast-changing APIs by relying on observed requests and responses instead of waiting for formal specifications to be written or updated.
Expanded Definition
Burp history import is a reconnaissance-to-documentation workflow in which captured HTTP traffic from Burp Suite is imported to infer an API service definition from observed requests and responses. In NHI and API security programs, it is used when the source of truth is missing, stale, or incomplete, and the team needs a practical view of how an application actually behaves. That makes it useful for undocumented service accounts, agent-driven endpoints, and legacy services that expose functionality without clean specification discipline. The resulting definition is usually operational rather than canonical, so it should be treated as a living artifact that supports analysis, testing, and governance rather than replacing formal interface management. Definitions vary across vendors on how much inference is acceptable, and no single standard governs this yet. For governance context, the NIST Cybersecurity Framework 2.0 remains a useful reference for asset visibility and control mapping. The most common misapplication is treating imported traffic as an authoritative API contract, which occurs when teams skip validation against actual backend behavior and authentication paths.
Examples and Use Cases
Implementing Burp history import rigorously often introduces review overhead, requiring organisations to weigh faster discovery against the risk of modelling only a partial slice of production behavior.
- A security team imports Burp traffic from a beta release to map endpoints before formal OpenAPI documentation exists, then uses the draft model to guide testing.
- An application owner captures Burp history from an internal workflow and imports it to identify hidden admin routes that were not included in the original service inventory.
- A red team uses imported history to compare observed request patterns against expected authentication flows, then checks whether token handling matches policy.
- An engineering group imports traffic from a mobile client to recover request parameters and response shapes after an API changed faster than its documentation could be updated.
- For broader NHI governance, the workflow is paired with the Ultimate Guide to NHIs to tie observed service traffic back to identity, secret, and rotation controls.
When teams need a standards anchor for the resulting service model, they often align it with the NIST Cybersecurity Framework 2.0 so discovery output can be folded into asset and access governance.
Why It Matters in NHI Security
Burp history import matters because NHI exposure often hides inside traffic patterns that documentation never captured. Imported histories can reveal service accounts, API keys, session tokens, and automation flows that quietly expand attack surface when they are not formally tracked. NHI Management Group notes that only 5.7% of organisations have full visibility into their service accounts, which means traffic-derived discovery can be one of the few practical ways to expose real operational dependencies. It also supports control verification when secrets are embedded in client flows or when ephemeral agent behavior changes faster than inventory systems can keep up. The same visibility challenge appears in the Ultimate Guide to NHIs, which highlights how incomplete oversight compounds risk across rotation, offboarding, and privilege review. The operational lesson is that imported history should trigger follow-up governance, not just testing. Organisations typically encounter the need for this term only after an undocumented integration fails, at which point the traffic archive becomes the only defensible path to reconstruct what the API actually did.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.1 | Burp imports improve understanding of assets and service behavior. |
| OWASP Non-Human Identity Top 10 | NHI-01 | Imported histories often expose service accounts, tokens, and secret usage. |
| OWASP Agentic AI Top 10 | LLM-05 | Observed tool and API calls can reveal agent behavior and hidden integrations. |
| NIST Zero Trust (SP 800-207) | SC-2 | Observed traffic helps verify real access paths under zero trust design. |
Inspect captured requests for secrets and non-human credentials before using the model.
