API No-Authentication Validation

Identify API operations that may be reachable without the authentication or authorization required by their data and business function. Discovery is read-only by default. Write validation uses synthetic records and requires explicit authorization immediately before execution.

When to Use

• Port scan reveals HTTP services on non-standard ports (3000, 5000, 8080-8085, 9000).
• Target has an API subdomain (api.target.com, backend.target.com).
• JavaScript bundles reference internal API endpoints.
• After port-service-discovery finds HTTP on unexpected ports.
• After firebase-supabase-attack identifies backend APIs.

Prerequisites