/api-security

API Security Testing

Thin router for API penetration testing. Use the index sections to load the specific workflow, payload file, or methodology doc for the phase you're in. Do not pre-load everything.

When to Use

• Pentesting a REST, GraphQL, gRPC, or WebSocket API.
• OWASP API Top 10 (2023) coverage assessment.
• BOLA / BFLA / BOPLA authorization matrix analysis.
• JWT / OAuth / API-key auth testing.
• Fuzzing endpoints, parameters, or schemas.
• Parsing and attacking OpenAPI / Swagger / GraphQL schemas.
• Rate-limit / resource-consumption testing.

Trigger Phrases

"pentest this API", "test the REST API", "test GraphQL security", "check for BOLA/IDOR", "analyze OpenAPI spec", "test API authentication", "JWT attacks", "fuzz API endpoints", "GraphQL introspection".

When NOT to Use This Skill

• Browser / DOM-based testing (XSS, CSP, clickjacking, client-side auth flows rendered in a browser) -> use dast-automation.
• Reviewing API source code for injection/authz bugs at the code level -> use sast-orchestration.
• Mobile client reversing to recover API endpoints from an APK/IPA -> use mobile-security first, then return here with the recovered spec.
• Cloud-provider IAM / API-gateway config auditing (not the API itself) -> use cloud-security.

Decision Tree

Is there a schema (OpenAPI / GraphQL SDL / .proto)?
  yes -> parse it first, feed endpoints.txt to fuzzers
  no  -> methodology/api_recon.md

What protocol?
  REST / JSON over HTTP -> workflows/rest_testing.md
  GraphQL               -> workflows/graphql_introspection_triage.md
                           then workflows/graphql_testing.md
  gRPC                  -> workflows/grpc_testing.md
  WebSocket             -> workflows/websocket_testing.md

Is a JWT in use?
  yes -> workflows/jwt_attack_chooser.md  (alg-none -> key-conf -> kid -> brute)

Primary finding target?
  Authorization bugs  -> methodology/bola_bfla_matrix.md  (HIGHEST yield)
  Misconfig / inventory -> nuclei + references/owasp_api_top10_2023.md (API8/API9)
  Injection / SSRF    -> payloads/injection.txt

Parallelism Hints

Run concurrently (independent I/O):

• Spec discovery: swagger.json, openapi.json, .well-known/openapi.json, v1/api-docs, v2/api-docs.
• Endpoint discovery: ffuf + kiterunner + katana can run on the same host.
• Auth enumeration: collect a token per role (unauth / user / admin / service) in parallel — each is a separate login flow.
• Nuclei exposures/, vulnerabilities/, misconfiguration/ template packs.

Keep sequential (state-dependent):

• Spec parse must finish before endpoint-driven fuzzers can consume it.
• Authorization matrix diffing must wait for all per-role scans to complete.
• JWT attack chain steps are ordered (see workflows/jwt_attack_chooser.md).

Sub-Agent Delegation

Spawn one sub-agent per auth context when building the BOLA/BFLA matrix:

• Agent U — unauthenticated
• Agent A — user-role (account A)
• Agent B — user-role (account B, cross-user)
• Agent X — admin-role (if available)
• Agent S — service / machine account (if applicable)

Each agent iterates the full endpoint list with its own token and returns {endpoint, method, status, body_hash, leaks_cross_user}. Main agent diffs the five result sets. This is the single biggest parallelism win in API pentesting.

For GraphQL, also delegate: one sub-agent enumerates all Query fields, another all Mutation fields, another maps ID-bearing types for BOLA targeting.

Reasoning Budget

• Extended thinking — authorization matrix analysis, JWT attack-path selection, GraphQL schema-driven attack planning, business-logic flow modeling (API6).
• Minimal / execute directly — payload fuzzing, nuclei runs, ffuf brute force, grpcurl calls, JWT decoding, spec parsing.

Multimodal Hooks

• Screenshots of Swagger / GraphiQL / Postman UIs can accelerate spec recovery when text scraping fails.
• For JWT and GraphQL evidence, prefer text blobs (evidence.jwt_header, evidence.graphql_query) over screenshots.

Structured Output

Every finding: schemas/finding.json. Required API-specific fields: endpoint, http_method, api_type (rest/graphql/grpc/websocket), auth_context, owasp_api_id (e.g. API1:2023).

Workflow Index

Methodology Index

Payloads Index

References Index

Examples Index

Tools

Full list: references/tools.md.

Last Validated

2026-04. Minimum tool versions: nuclei >= 3.3, ffuf >= 2.1, grpcurl >= 1.9, jwt_tool >= 2.2, graphql-cop >= 1.13.