A penetration tester is preparing to conduct API testing. Which of the following would be MOST helpful in preparing for this engagement?

Nikto is a web server vulnerability scanner focused on HTTP misconfigurations and outdated software versions, not on documenting or discovering API endpoint structure.

WAR is not a recognized API documentation or discovery tool in penetration testing; a Java WAR archive is a deployment package, not a resource for understanding API attack surfaces.

W3AF is a general web application attack and audit framework targeting vulnerabilities such as XSS and SQL injection, and does not provide the structured API endpoint documentation that Swagger offers.

Swagger is an OpenAPI specification tool that enumerates every available endpoint, HTTP verb, request parameter, response schema, and authentication requirement in a machine-readable format, enabling a tester to systematically map and attack the API without blind enumeration.