API security testing: what a tester checks first

An API does exactly what it is asked, by anyone who can reach it. There is no interface to hide a mistake.

The first checks

1. Who can call this? Does each endpoint require authentication, and does it check the caller's rights on the specific object requested?
2. What does it return? Are responses limited to the fields the client needs, or is the whole record sent for the interface to hide?
3. What does it accept? Are unexpected fields, types and sizes rejected, or used as given?
4. How often? Is there a limit on requests, and is that limit itself cheap to enforce?
5. What do errors say? Messages that reveal internal paths or queries help an attacker.
6. What is forgotten? Old versions, test endpoints and undocumented routes still live in production.

Tip

Give your testers the API description (for example an OpenAPI file) and accounts for each role. It saves discovery time and moves effort to the checks above.