API Security Testing

I test APIs within an agreed scope by first understanding the available endpoints, methods, parameters, authentication flow, and important application functions. Testing can include authentication, authorization, object-level access control, token and JWT handling, input validation, error responses, rate limiting, HTTP methods, and unnecessary data returned by the API. I review requests and responses to understand how the API behaves and manually validate potential security issues before reporting them. Findings are documented with the affected endpoint or function, technical evidence, impact, reproduction information where appropriate, and recommended changes.