API Security Assessment
Manual API Security Testing — OWASP API Top 10, Authorization Model Review, and Business Logic Exploitation
APIs are the primary attack surface for modern applications, and they fail in ways that traditional web application testing does not cover. Broken Object-Level Authorization (BOLA/IDOR) is the most common API vulnerability — and automated scanners cannot find it because it requires understanding the application's data model and authorization logic.
This assessment is manual, API-focused security testing against the OWASP API Top 10. Coverage includes BOLA/IDOR, broken authentication (JWT, OAuth 2.0, PKCE), mass assignment, function-level authorization, injection, and business logic vulnerabilities. The authorization model is reviewed holistically to identify systemic patterns — not just individual broken endpoints.
Every finding includes proof-of-concept request/response pairs that your engineering team can reproduce and verify. The assessment covers REST, GraphQL, SOAP, gRPC, and WebSocket APIs.
Who This Is For
Ideal clients for this engagement.
The Problem
What this engagement addresses.
Broken Object-Level Authorization (BOLA/IDOR)
The most common and highest-impact API vulnerability. Users access other users' data by manipulating object identifiers. Scanners cannot detect BOLA because it requires understanding the relationship between authenticated identity and data ownership.
Broken Authentication Flows
JWT misconfigurations (algorithm confusion, weak signing, missing expiration), OAuth 2.0 implementation flaws (PKCE bypass, redirect URI manipulation, scope escalation), and session management weaknesses that traditional testing overlooks.
Mass Assignment and Function-Level Authorization
APIs that accept more parameters than intended allow attackers to modify fields they should not have access to — roles, permissions, billing status, internal flags. Function-level authorization gaps expose admin endpoints to regular users.
Business Logic Vulnerabilities
Race conditions, workflow bypass, parameter tampering, and state manipulation that exist in the application logic layer — invisible to scanners and only discoverable through manual testing with business context understanding.
Assessment Coverage
What we test — systematically.
Systematic BOLA/IDOR testing across all resource endpoints. Horizontal and vertical access control validation. Multi-tenant isolation testing.
JWT implementation review, OAuth 2.0/PKCE flow testing, session management, credential stuffing resistance, and MFA bypass testing.
Mass assignment testing across create and update operations. Response filtering validation — ensuring APIs do not return properties beyond the caller's authorization.
Rate limiting validation, pagination abuse, resource-intensive query testing (especially GraphQL), and batch operation abuse.
Administrative function exposure to regular users. Privilege escalation through API endpoint discovery and method manipulation.
Race conditions, workflow bypass, parameter tampering, injection vectors (SQL, NoSQL, command, SSRF), and GraphQL-specific attacks (batching, deep nesting, alias abuse).
Deliverables
What you receive.
Technical Findings Report
Each finding with OWASP API Top 10 category, risk rating, proof-of-concept request/response pairs, business impact, and remediation guidance. Authorization model findings distinguished as systemic (design-level) vs. point (implementation-level) issues.
Executive Summary
Non-technical summary of API security posture, authorization model effectiveness, top findings with business impact, and strategic remediation priorities for security and engineering leadership.
Authorization Model Review
Holistic assessment of the API's authorization architecture — systemic patterns, enforcement consistency, and design-level recommendations. Not just a list of broken endpoints, but an analysis of why they are broken.
Remediation Retest Report
Verification of Critical and High finding remediations within 90 days. Updated proof-of-concept evidence confirming resolution or continued exposure.
Methodology
How the engagement works.
API Discovery & Authorization Mapping
Week 1
- API endpoint discovery and documentation review (OpenAPI/Swagger, GraphQL schema)
- Authentication mechanism analysis (JWT, OAuth 2.0, API keys, session tokens)
- Authorization model mapping — roles, permissions, resource ownership
- Test account provisioning across authorization levels
Manual Security Testing
Weeks 1 – 3
- OWASP API Top 10 systematic testing
- BOLA/IDOR testing across all resource endpoints
- Authentication bypass and token manipulation
- Mass assignment and function-level authorization testing
- Business logic and injection testing
- Protocol-specific testing (GraphQL, gRPC, WebSocket)
Reporting & Debrief
Within 5 business days of test completion
- Technical findings report with proof-of-concept request/response pairs
- Authorization model review delivery
- Executive summary delivery
- Live debrief with engineering team
Engagement Tiers
Scoped to your architecture.
Focused
Single API with up to 50 endpoints. One authentication mechanism. Suitable for a single microservice or product API.
- OWASP API Top 10 coverage
- BOLA/IDOR and authorization testing
- Technical findings report with PoC request/response pairs
- Remediation retest within 90 days
Standard
Single API with 50-150 endpoints or multiple related APIs. Complex authentication (OAuth 2.0, multi-tenant). Includes authorization model review.
- Everything in Focused
- Authorization model review (systemic vs. point issues)
- Business logic testing
- GraphQL/gRPC-specific testing where applicable
Comprehensive
API platform with 150+ endpoints, multiple API types (REST + GraphQL), multi-tenant authorization, and partner/third-party integrations.
- Everything in Standard
- Full platform authorization model assessment
- Cross-API trust boundary testing
- Partner and third-party integration security review
Prerequisites
- API documentation (OpenAPI/Swagger specs, GraphQL schema, or equivalent)
- Test accounts across all authorization levels (admin, regular user, partner, etc.)
- Access to staging or production environment as agreed in rules of engagement
- Description of multi-tenancy model and resource ownership logic
Frequently Asked Questions
Common questions.
How is this different from a regular penetration test?
A general penetration test covers broad attack surface — network, web application, infrastructure. This assessment is API-specific: deep authorization model review, BOLA/IDOR testing across every resource endpoint, authentication flow analysis, and business logic testing. The depth on API-specific vulnerabilities is significantly greater than what a general pen test covers.
Do you test GraphQL APIs differently than REST APIs?
Yes. GraphQL introduces unique attack surface — schema introspection, batching attacks, deep query nesting for denial of service, alias-based BOLA, and field-level authorization bypass. The testing methodology adapts to the API protocol. gRPC and WebSocket APIs also receive protocol-specific testing.
What if we do not have complete API documentation?
The engagement begins with API discovery — endpoint enumeration, schema analysis, and traffic observation. Documentation is helpful but not required. Many assessments uncover undocumented endpoints that represent significant attack surface.
Related Offerings
Often paired with this engagement.
Penetration Testing
Broader adversary-perspective testing across network, web application, and cloud infrastructure — when API testing alone is not sufficient.
Secure Code Review
White-box review of the API source code — find authorization logic flaws, injection sinks, and authentication implementation issues at the code level.
AppSec Program Design
Build API security standards and secure coding guidelines into your development program — OWASP API Top 10 coverage as part of your SDLC.
Threat Modeling Workshops
Proactive threat identification for API architectures — define trust boundaries and authorization requirements before they become findings.
Ready to discuss this engagement?
30-minute discovery call. We will discuss your application architecture, your specific concerns, and whether this assessment is the right fit.