API Security Testing Checklist

Gather all available API documentation including versioning information.

Document all authentication methods and obtain valid test credentials.

Clarify whether deprecated API versions and internal APIs are in scope.

Configure Burp Suite or mitmproxy with appropriate certificate pinning bypasses.

Agree on maximum request rates to avoid triggering denial-of-service conditions.

Use tools like Kiterunner or ffuf with API-specific wordlists to find hidden endpoints.

Test /v1/, /v2/, /api/beta/ and similar patterns for accessible legacy versions.

Check for verbose stack traces, internal IP addresses, and technology disclosure.

Send OPTIONS requests and test PUT, DELETE, PATCH methods on read-only endpoints.

Query __schema and __type to enumerate all available queries, mutations, and types.

Manipulate resource IDs in API calls to access objects belonging to other users.

Attempt to call admin-only API functions using regular user tokens.

Verify that responses only contain fields necessary for the client and no sensitive internal data.

Try none algorithm, RS256/HS256 confusion, expired tokens, and signature stripping.

Attempt brute-force attacks on login, password reset, and OTP endpoints.

Send additional fields in request bodies to modify unintended properties like role or isAdmin.

Test for injection attacks, type confusion, and boundary value issues in request parameters.

Demonstrate full impact by combining authorization flaws with excessive data exposure.

Inject internal URLs into webhook, callback, and image URL parameters.

Test for denial-of-service through deeply nested queries and batch brute-force attacks.

Inject MongoDB operators ($gt, $ne, $regex) into JSON request bodies.

Confirm that Access-Control-Allow-Origin is not overly permissive with credentials.

Include cURL commands or Postman collections for reproducibility.

Classify each vulnerability against the relevant API Security Top 10 category.

Recommend middleware-level fixes, input validation schemas, and authorization patterns.

Attach raw output from API scanning tools with false positives clearly marked.

Ensure all API keys, tokens, and test accounts are invalidated post-engagement.