Download websites that use Swagger UI

About Swagger UI

A page rendered by Swagger UI is a public declaration that a company has an API and wants people to use it. The tool turns an OpenAPI description into a browsable interface where a developer reads every endpoint, expands every parameter and fires live requests straight from the browser, and organisations put it on a public hostname on purpose. Finding it on a domain answers a commercial question before it answers a technical one: this organisation exposes programmable access to something it owns.

SmartBear Software maintains the project as Apache 2.0 code written in JavaScript, with a history reaching back to 2011 and to the original specification format that later became OpenAPI. The interface is assembled in the browser from a static description file, which is precisely why it can be detected. A documentation portal built with it ships recognisable asset names and a predictable page structure, and both survive on almost every deployment, because teams that happily restyle a marketing site rarely bother restyling developer documentation.

As of September 2026 we see Swagger UI on 1,793 sites, filed under Documentation. The interesting column on those rows is the version. Across the detected population we track 9 distinct releases, and the one we record most frequently is 4.18.3. Version spread matters more here than it does for most front end libraries, because the tool has a history of cross site scripting issues fixed in particular releases, and a documentation portal is exactly the kind of asset that never gets a maintenance window. A portal pinned to an old release is usually a portal nobody owns.

Deployment style shapes what can be seen at all. Some organisations serve documentation from a subdomain of their main site, some from a hosted developer portal product, and some keep the interface inside a corporate network where no crawler will ever arrive. Detection covers the public and self hosted cases, undercounts anything behind authentication, and cannot see the much larger number of teams that run the tool only on their own machines during development.

For a researcher the resulting file is a directory of companies with programmable products, which is a genuinely hard thing to assemble any other way. Nobody publishes a register of who operates a public API. Sales teams selling API gateways, contract testing, monitoring, documentation hosting or application security want that population split by country, industry and top level domain. Security researchers want it split by version. Analysts want to know which sectors are becoming programmable and how fast the set is growing.

A per domain lookup tells you whether one company documents an API today. The export tells you who is in the population, how it is versioned, what else those domains run, and how the whole group differs between one dated snapshot and the next, which is the difference between confirming a fact and doing research.