If you cannot perform an active security scan on a third-party API, you need to provide:
1. **Documentation on the Third-Party API**: Include details about the API, such as its purpose and integration with your app.
2. **Security Certifications or Reports**: Submit any security certifications or reports conducted by the third party, like a penetration test report.
3. **Explanation Statement**: Provide a statement explaining why the scan cannot be performed and include relevant details about the third-party system's security measures.
When integrating with external APIs that don't allow active scanning for the AppExchange Security Review, you need to provide the following documentation:
1. Detailed solution documentation, including architecture diagrams or descriptions.
2. Postman collections of all the APIs being used.
3. Credentials for the third-party application or service, if applicable.
4. False-positive documentation, if relevant.
5. Any additional details about the external API's functionality and security measures.
This documentation helps the review team assess the integration's security without active scanning and demonstrates the security posture of the third-party API in your submission.