What does APIsec test for?

APIsec is designed to test your whole application for security risk, not to check a single published list. Its test categories are built to cover the real risk surface of an API, and they draw on many industry frameworks rather than being fitted to any one of them. Those influences include the OWASP API Security Top 10, SANS (such as the CWE/SANS Top 25), MITRE ATT&CK, ISO 27001, PCI DSS, and HIPAA/PHI, among others.

Treat these frameworks as lenses that inform and align with APIsec's coverage, not as a per-technique mapping. The result is a broad set of checks organized around security risk domains, which is how this page presents them.

Coverage is continually expanding, so treat this as a snapshot of what runs today rather than a fixed list.

Coverage at a glance

Risk domain	What APIsec tests for
Access control & authorization	Object-level (BOLA), predictable IDs, role/function-level (RBAC), property-level
Authentication & token integrity	Unauthenticated access, credential enforcement, OAuth2 flaws, JWT/token suite
Injection	Time-based SQL/NoSQL and OS-command injection
Transport & cryptographic security	SSL/certificate strength, TLS version, expiry, key size, HTTPS enforcement
Security misconfiguration & headers	CORS, HSTS, MIME nosniff, cookie flags, rate-limit headers
Sensitive data exposure	PII in responses, error/stack-trace leakage, server and network disclosure
Server-side request forgery	Attacker-controlled URLs injected into parameters
Resource consumption / denial of service	Pagination-based DoS
API inventory & discovery	Undocumented HTTP methods, well-known endpoint discovery

Access control & authorization

APIsec tests whether users can reach data and operations they should not. This covers object-level authorization (BOLA), where one user manipulates identifiers to access another user's objects, and predictable or incremental resource IDs that make such enumeration easier (often called IDOR). It also covers role-based and function-level access control (RBAC), which confirms each role can reach only its permitted operations, and property-level authorization, which catches mass assignment where a client sets server-side or read-only fields it should not control.

For depth, see the BOLA reference and the RBAC reference.

Authentication & token integrity

APIsec checks several ways authentication can break down:

• Unauthenticated access to endpoints that should require credentials.
• Partial credential enforcement, by leaving out one part of a composite credential to see whether access is still granted.
• OAuth2 weaknesses, including authorization-code replay and open redirect.
• JWT and token integrity, a broad suite covering alg:none and unsigned tokens, algorithm confusion (RS256 downgraded to HS256), iss and jku header misuse, tampered claims such as sub, email, and exp, and AWS Cognito ID tokens presented as access tokens.

Injection

APIsec uses time-based techniques to detect injection at the database and shell level:

• SQL and NoSQL injection across MySQL, PostgreSQL, SQL Server, Oracle, and MongoDB.
• OS-command injection across Linux shells and the Windows command shell and PowerShell.

Transport & cryptographic security

APIsec inspects how your API protects data in transit. It checks SSL and certificate strength, TLS version, certificate expiry, key size, and whether HTTPS/SSL is enforced.

Security misconfiguration & headers

APIsec looks for missing or weak protective headers, including CORS, HSTS, MIME nosniff, cookie flags, and rate-limit headers. These settings shape how browsers and clients handle responses, and gaps here widen the attack surface.

Sensitive data exposure

APIsec flags information a response should not reveal. This includes personally identifiable information (PII) returned in responses, stack traces and error leakage, and disclosure of server and version details or internal network information.

Server-side request forgery (SSRF)

APIsec injects attacker-controlled URLs into parameters to detect whether the server can be tricked into making requests on the attacker's behalf.

Resource consumption / denial of service

APIsec tests for pagination-based denial of service, sending oversized pagination parameters to see whether the API returns unbounded results or degrades.

API inventory & discovery

APIsec probes for undocumented HTTP methods on known endpoints and discovers OIDC and JWKS well-known endpoints, helping you find surface area you may not have accounted for.

Informational findings

Alongside vulnerabilities, APIsec surfaces informational findings that describe API behavior worth knowing about, such as JWT conformance details and the well-known endpoints it discovers. These are context rather than defects, and they help you understand your API's posture.

Framework alignment

Where applicable, findings map to the OWASP API Security Top 10 (2023) and feed reporting for different standards and audiences, so the same test results support both security remediation and compliance evidence. APIsec produces:

• OWASP Coverage Report
• PCI DSS 4.0 Compliance Report
• ISO/IEC 27001 Compliance Report
• Penetration Testing Report
• Developer Report

See your coverage in the console

The categories on this page describe what APIsec tests for in general. To see the suite generated for one of your own applications, open its Security Coverage tab.

APIsec builds a test suite for an application when you register it, aligned to the OWASP API Security Top 10. The tab shows:

• the full set of tests generated for that application
• the attack vectors those tests cover
• coverage grouped by category, such as authorization, authentication, and token security
• the specific risks being probed, including BOLA, broken authentication, and tampered tokens

See also

Once a scan runs, here is where its results show up:

• View vulnerabilities — review findings by severity, endpoint, and category.
• Threat detection — see threats grouped across endpoints.
• BOLA — object-level authorization coverage in depth.
• RBAC — role-based access control coverage in depth.
• Security Hub — a consolidated view of your security posture.