Object authorisation
Access to others' records by changing identifiers in paths, parameters or request bodies.
API test focus
Indicative view, not a measurement: 3 primary focus, 2 usual component, 1 context or scope-dependent, 0 outside normal scope.
| Area | Level |
|---|---|
| Authentication and sessions | primary focus |
| Authorisation and permissions | primary focus |
| Inputs and injection | part of the test |
| Business logic | primary focus |
| Configuration and exposure | part of the test |
| Data and secrets | primary focus |
APIs control data without a user interface
An interface may hide a button, but the API processes any request it receives. We test operations directly to verify server-side permissions and validation.
We test REST, GraphQL, webhooks, mobile and partner APIs. Other interface types are assessed during scoping. Operation, role and integration counts chiefly determine scope.
- Object, property and function-level authorisation.
- Token and key issuance, validity, scope and revocation.
- Input validation, mass assignment and server-side request forgery.
- Limits, pagination and resource consumption.
- Inventory of versions, environments and undocumented operations.
- Handling of data received from third-party APIs.
Test process and rules
We start with specifications such as OpenAPI or GraphQL schemas and sample requests. Testing without documentation is possible, but mapping takes longer and coverage may be narrower.
Before testing, we confirm written authorisation and Rules of Engagement: environment, operations, accounts and tokens, intensity limits and stop procedures. Operations affecting data or third parties, such as payments or messages, are excluded or restricted in advance.
Risk categories follow OWASP API Security Top 10 (2023), with procedures informed by OWASP WSTG. These are methodological frameworks, not certification or complete coverage guarantees.
Typical finding categories
Properties and functions
Returning or accepting properties callers should not access or change; ordinary users invoking administrative operations.
Tokens and authentication
Insufficient token validation, excessive scope, missing revocation or weak login protection.
Limits and business flows
Unrestricted resource consumption, automatable sensitive operations and bypassed pagination or quotas.
Inventory and integrations
Forgotten versions and environments, server-side request forgery and uncritically trusted third-party API data.
Each finding backed by a specific request
Retesting and developer consultations can follow as specified in the proposal.
- Risk and priority summary for management and product owners.
- Requests, responses and reproduction steps without unnecessary sensitive data.
- Affected operations, roles and API versions.
- Recommended design and implementation fixes.
- Scope, assumptions and limitations, including untested operations.
What we need from you
- API specification or request collection and main business flow descriptions.
- A test environment and accounts or tokens for every agreed role, ideally two per role.
- Details of limits, safeguards and prohibited operations.
- A technical contact for questions and escalation during testing.
