API Security Testing (FIND/EXPLOIT — OWASP API Top 10)

Overview

Modern apps are API-first, and APIs fail differently from web pages: the bugs are in authorization per object/field and resource limits, not rendering. Test the API directly, bypassing the UI entirely.

Core principle: The UI is one client; attackers talk to the API raw. Every endpoint, field, and method must enforce authz and limits on its own — the front-end protects nothing.

Applies when / Skip when

• Applies when: the app exposes a programmatic API — REST, GraphQL, gRPC, or WebSocket — including the API behind a SPA or mobile client.
• Skip when: the app is purely server-rendered HTML with no API anyone calls → N/A.
• If N/A: report "api-security-testing: N/A — no API surface" and stop.

⚠️ Authorization

Your own/authorized API. Use test accounts and a non-production instance for stateful tests.