The Montoya API is Burp Suite’s modern extension interface for building add-ons in a more developer-friendly way. It provides structured access to proxy traffic, logging, persistence, and other platform capabilities. Compared with older extension interfaces, it reduces boilerplate and makes common message handling tasks easier to implement.
What the Montoya API is for
The Montoya API is Burp Suite’s modern extension interface, designed to make add-on development more structured and less boilerplate-heavy than earlier APIs. It gives extension authors cleaner access to proxy traffic, message handling, logging, and persistence so they can build more maintainable tooling.
How it changes Burp extension development
For practitioners, the main value is not just convenience, but a better extension model. Montoya encourages code that is easier to read, test, and extend, which matters when an add-on needs to inspect requests, transform messages, or retain state across sessions.
That shift reduces friction for common automation tasks, especially where older extension styles required more manual wiring. It also makes it easier to build extensions that fit Burp’s platform conventions instead of layering ad hoc logic around them.
Core capabilities exposed by the API
Montoya exposes the extension points developers typically need when working inside Burp’s runtime. That includes listening to traffic, observing or modifying messages, persisting data, and integrating with platform services in a more deliberate way.
Those capabilities make it useful for a range of security workflows, including passive analysis, request mutation, custom reporting, and operational tooling that needs to track state over time. The API is an interface layer, so its value depends on how safely and precisely the extension uses the hooks it provides.
Security implications of extension interfaces
Any extension API that can observe or modify traffic becomes part of the trust boundary of the testing tool itself. If an extension mishandles sensitive data, stores state carelessly, or applies overly broad message processing, it can create leakage, integrity, or operational risk inside an otherwise trusted workflow.
Because extensions often run with access to live proxy content, developers need to treat message handling, persistence, and logging as security-relevant behaviors, not just convenience features.
OWASP API Security Top 10 is a useful reference point when you are evaluating whether an extension interface introduces authorization, exposure, or abuse paths through the messages it processes.
Risk and Threat Considerations
Extension APIs are attractive targets because they sit close to sensitive traffic and often inherit the user’s trust in the testing environment. A poorly written Montoya extension can amplify exposure by logging secrets, persisting intercepted data insecurely, or modifying requests in ways that obscure what was actually tested.
Failure mechanism: Overbroad access to proxy content or unsafe persistence creates a path for accidental leakage, unintended retention, or extension-driven tampering with requests and responses.
Impact: Sensitive data can be exposed, test results can become unreliable, and the extension can undermine confidence in the workflow that depends on it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API8 — Security Misconfiguration | Extensions that process API-like traffic can expose auth and handling weaknesses. |
| API2 — Broken Authentication | Montoya extensions may observe or handle authenticated traffic and tokens. | |
| API5 — Broken Function Level Authorization | Extension logic can overreach when it acts on messages or tooling functions. | |
| Recommendation — Review extension request handling for auth, exposure, and unsafe processing paths. Protect intercepted authentication material and validate any auth-related handling. Constrain extension actions to the minimum functions they genuinely need. | ||
| NIST SP 800-53 Rev 5 | AU-9 — Protection of Audit Information | Logging and persistence in extensions can expose sensitive recorded traffic. |
| SC-28 — Protection of Information at Rest | Persisted extension state may contain intercepted request or response data. | |
| Recommendation — Limit and protect extension logs so captured traffic is not leaked or altered. Encrypt stored extension data that can include sensitive traffic content. | ||
Practitioner Guidance
Why practitioners should care: Montoya is best treated as a platform capability that can shape both productivity and risk. Extension authors should design for minimal data handling, narrow message scope, and explicit state management so the add-on remains predictable when used against real traffic.
Practitioner takeaway: The cleaner API surface is an opportunity to build safer extensions, but only if developers apply the same discipline they would use for any code that touches live security-sensitive data.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
