API testing methodology (work top to bottom)

Confirm scope first (tradecraft-scope-roe). Each phase links to the skill that goes deep — load it, work its cheatsheet.md where present, and don't mark a phase failed until you've covered it (house rule: fuzz every input/context/encoding, blind/OOB). This is your coverage map.

1 · Discover & map the surface

• Find the API: /api, subdomains, JS files (recon-js-analysis), mobile/SPA traffic (recon-content-discovery)
• Grab the spec: swagger.json / openapi.json / GraphQL introspection / .proto — enumerate every endpoint, method, param
• Note auth model (Bearer/JWT/API key/cookie/mTLS), versions (/v1,/v2), and content types
• Map roles: create two accounts (and an unauth client) — you need them for access-control tests

2 · Authentication

• Token flaws — JWT alg/kid/key confusion (web-auth-jwt), API-key leakage/predictability
• Auth attacks — credential stuffing, weak/OTP flows, token not expiring/rotating (api-auth-attacks)
• Unauthenticated endpoints that shouldn't be