Very neat - I imagine you could even use this as a web scanner to identify security misconfigurations in API implementations (e.g. broken access control)