REST API Security Testing

This guide treats REST and JSON APIs as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   Collect approved base URLs, versions, OpenAPI documents, and owner contacts.

2. 02

   Map authentication, roles, tenants, objects, fields, and asynchronous jobs.

3. 03

   Create synthetic objects for every designated role.

4. 04

   Record normal response schemas, errors, pagination, and rate-limit headers.

curl -sS -i https://api.lab.example/v1/profile \
+  -H "Authorization: Bearer REDACTED_TEST_TOKEN" \
+  -H "Accept: application/json"

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Test object and function authorization one boundary at a time.

2. 02

   Validate request and response schemas, content types, and unsupported methods.

3. 03

   Check pagination, filtering, bulk, export, and asynchronous result endpoints.

4. 04

   Confirm deprecated versions and shadow endpoints follow the same controls.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Log identity, route template, object type, policy decision, latency, and response class.
• Alert on enumeration, repeated denials, schema failures, and rate-limit bypass patterns.
• Never log bearer tokens or sensitive response bodies.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Maintain an authoritative API inventory and retirement process.
• Enforce centralized authentication and server-side authorization.
• Apply schema validation and resource-aware rate limits.
• Use consistent errors and security regression tests.