# API Security Testing

> Security testing checklist for HTTP APIs—authn/z, input validation, rate limits, sensitive data exposure, and common OWASP API issues. Use when reviewing or testing REST/GraphQL endpoints before release.

- Skill: `charlieviettq/api-security-testing` (Agent Skill)
- Install (CLI): `npx skillmds@latest add charlieviettq/api-security-testing`
- Raw SKILL.md: https://api.skillmd.com/api/skills/charlieviettq/api-security-testing/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: charlieviettq (https://skillmd.com/u/charlieviettq)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/charlieviettq/api-security-testing

---


# API security testing

## Preconditions

- Test in **non-production** unless explicitly authorized.
- Use dedicated test accounts; never real customer PII in payloads.

## Test matrix (prioritized)

### Authentication and session

- [ ] Missing/invalid token rejected (401)
- [ ] Expired or revoked credentials rejected
- [ ] Session fixation / cookie flags (HttpOnly, Secure, SameSite) where applicable

### Authorization

- [ ] Horizontal: user A cannot access user B's resource IDs
- [ ] Vertical: non-admin cannot invoke admin routes
- [ ] IDOR on path/query/body identifiers

### Input and abuse

- [ ] Oversized payloads rejected
- [ ] Injection surfaces parameterized (SQL, command, template)
- [ ] Rate limiting on auth and expensive endpoints

### Data exposure

- [ ] Errors do not leak stack traces or secrets in prod-like config
- [ ] Responses omit internal fields (tokens, hashes, full PAN)
- [ ] Pagination does not bypass auth filters

### Transport and config

- [ ] HTTPS enforced; HSTS where applicable
- [ ] CORS not `*` with credentials
- [ ] Security headers on API gateway if present

### Web-facing surfaces (when API serves or pairs with UI)

- [ ] CSP or explicit script policy documented
- [ ] CSRF protection on cookie-based mutations
- [ ] Clickjacking headers (`X-Frame-Options` or CSP `frame-ancestors`) where relevant
- [ ] File upload: type/size limits, virus scan hook if required by policy

## Reporting

For each finding: endpoint, steps, impact, severity, remediation, retest status.

## Boundaries

- Defensive testing only; no unauthorized production scanning.
- For deep pen-test, engage formal AppSec process.