Burp Montoya API is a Java API for building extensions for the Burp Suite application. It provides programmatic access to Burp data, HTTP traffic and UI extension points so developers can automate testing, inspect requests and responses, and add custom analysis or manipulation features.
What Burp Montoya API Does
Burp Montoya API is the extension development interface for Burp Suite, so its core value is not the scanner itself but the ability to program against Burp’s internal data, traffic, and user interface hooks. That makes it the practical layer where security researchers and tooling developers turn Burp from an interactive application into an extensible platform.
Because it exposes traffic and UI extension points, the API sits close to the browser, proxy, and analysis workflows that extensions depend on. In practice, that means the API’s design influences what an extension can observe, modify, automate, and surface to the operator during testing.
Extension Architecture and Programming Model
Montoya API is a Java API, so extension logic is written as code rather than configured as a simple plugin profile. That matters because developers can create custom analysis, add checks, hook into events, and build workflows that reflect a team’s own testing methodology instead of relying only on built-in Burp features.
The programming model is especially useful when an extension needs to keep state, transform request and response data, or coordinate several extension behaviors together. It gives developers a structured way to create tools that are repeatable, versionable, and easier to maintain than one-off manual workflows.
Traffic Inspection and Test Automation
One of the main reasons practitioners use the Montoya API is to automate inspection of HTTP traffic. Extensions can analyze requests and responses, flag patterns, enrich data, or manipulate content as it passes through Burp, which is useful for repetitive testing and for enforcing custom review rules.
This is where the API becomes especially valuable for scale. Instead of manually replaying or reviewing every interaction, teams can encode checks for headers, parameters, token handling, reflected content, or other signals that matter to their application security testing process.
Custom Analysis, Reporting, and UI Integration
The API also supports extension points for adding bespoke analysis and user interface behavior. That allows teams to present findings in the way they want, add workflow shortcuts, or build helper views that make complex testing faster to navigate.
For mature testing teams, this is often the difference between a generic tool and a tailored platform. The extension can surface findings in context, reduce analyst friction, and make a repeatable test method easier to apply across many targets or engagements.
Risk and Threat Considerations
Extensions built with the Montoya API can observe and alter sensitive traffic, so the main risk is not the API itself but the trust placed in extension code. A poorly reviewed or malicious extension can mishandle secrets, record data it should not retain, or change traffic in ways that distort test results or create unintended side effects.
Failure mechanism: An extension with broad access to requests, responses, and UI hooks can become a high-impact execution surface if code quality, provenance, or review discipline is weak.
Impact: Sensitive data exposure, unreliable test output, and unsafe request or response manipulation can undermine both security testing integrity and operator trust in Burp-driven workflows.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V16 — Security Logging and Error Handling | Burp extensions often inspect and report security findings from application traffic. |
| Recommendation — Use V16 to ensure extension output is logged, traceable, and fails safely during analysis. | ||
| OWASP API Security Top 10 | API8 — Security Misconfiguration | Extensions operate on API traffic and can expose misconfiguration or tamper with requests. |
| Recommendation — Test API exposure and request handling with API8-focused checks in your Burp extension workflow. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | Burp extensions are application code that must be developed, reviewed, and maintained securely. |
| Recommendation — Review extension code under CIS-16 to reduce defects and unsafe behaviours in security tooling. | ||
Practitioner Guidance
Why practitioners should care: Treat Montoya-based extensions as privileged tooling. The extension inherits the tester’s visibility into live traffic and can materially affect how findings are generated, so code review and provenance matter as much as functional correctness.
Common misunderstanding: A Burp extension is not automatically “safe” because it is used for security work. The same extension mechanisms that improve productivity also expand the blast radius if the code is untrusted, overly broad, or poorly handled.
Practitioner takeaway: Use Montoya API extensions as controlled testing components, not disposable add-ons, and keep a clear boundary between automation convenience and the data the extension is allowed to process.
Related resources from NHI Mgmt Group
- What is the difference between using Burp’s older extender API and the Montoya API for extension development?
- What is the difference between workload identity and API keys for AI agents?
- What is the difference between role-based access and API key governance for NHI security?
- How should security teams govern API keys used for generative AI access?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org