During WebAPI fuzzing, beSTORM is fuzzing the body and URL (with parameters), not the header.