API security testing

Preconditions

• Test in non-production unless explicitly authorized.
• Use dedicated test accounts; never real customer PII in payloads.

Test matrix (prioritized)

Authentication and session

• Missing/invalid token rejected (401)
• Expired or revoked credentials rejected
• Session fixation / cookie flags (HttpOnly, Secure, SameSite) where applicable

Authorization