API Security Tester

Purpose

Run a complete API assessment cycle with strong evidence discipline and predictable output.

Inputs

• target_base_url
• api_spec_or_collection
• auth_context
• engagement_rules

Standard Test Order

1. Discovery and endpoint normalization.
2. Auth and authorization checks.
3. Input handling and injection checks.
4. Workflow and state-machine abuse checks.
5. Impact confirmation and verification.

Execution Workflow

Phase 1: Discovery

• Build endpoint and trust map.
• Confirm content types, schema validation, and versioning.
• Identify sensitive operations and privileged paths.

Phase 2: Access Control

• Test object-level access control.
• Test function-level authorization by role.
• Test tenant boundary isolation.

Phase 3: Input Abuse

• Injection candidates by sink class.
• Mass assignment on create/update.
• Filter/operator abuse on search APIs.

Phase 4: Workflow Abuse

• Bypass prerequisite steps.
• Replay or reorder transitions.
• Abuse bulk and async operations.

Phase 5: Verification

• Independently confirm positives.
• Capture remediation-relevant root cause.
• Downgrade or dispute weak findings.

Minimum Test Matrix

Output Contract

{
  "scope_summary": {},
  "test_log": [],
  "confirmed_vulnerabilities": [],
  "verification_notes": [],
  "remediation_guidance": []
}

Constraints

• Keep tests reproducible and proportional.
• Do not overclaim severity without business impact.

Quality Checklist

• Coverage includes auth, authz, input, workflow.
• Findings include clear exploit path.
• Remediation ties to code/control failure.

Detailed Operator Notes

Reproducibility Standard

• Replay each confirmed case in a fresh session.
• Replay with at least one payload or transport variant.
• Keep one negative control request for every positive claim.

False-Positive Controls

• For timing signals, compare against matched control payloads.
• For authz signals, verify with ownership-correct and ownership-incorrect objects.
• For parser signals, verify semantic effect, not just error shape changes.

Severity Calibration Inputs

• Required attacker privilege.
• Cross-tenant or single-tenant impact.
• Ability to automate at scale.
• Degree of data sensitivity.

Reporting Rules

• Include exact request signatures (method, path, key headers, payload hash).
• Include verification run count and consistency notes.
• Include why alternative explanations were rejected.

Conditional Decision Matrix

Advanced Coverage Extensions

1. Add negative-object tests for soft-deleted or archived resources.
2. Add replay-window tests for idempotency and duplicate processing.
3. Add bulk endpoint abuse tests for partial authorization failures.
4. Add asynchronous job handoff checks for stale permission snapshots.
5. Add pagination/filter abuse checks for hidden data exposure.