API Security Testing: A Practical Checklist for 2025

Introduction

APIs are the backbone of modern applications — and the primary target for attackers. With microservices, mobile apps, and third-party integrations all relying on APIs, a single vulnerability can expose entire systems. This practical checklist covers what every security team should test when assessing API security in 2025.

OWASP API Security Top 10

The OWASP API Security Top 10 provides the foundation for API testing. The key risks include:

• API1: Broken Object Level Authorization (BOLA) — Accessing objects belonging to other users
• API2: Broken Authentication — Weak auth mechanisms allowing impersonation
• API3: Broken Object Property Level Authorization — Mass assignment and excessive data exposure
• API4: Unrestricted Resource Consumption — Missing rate limits enabling DoS
• API5: Broken Function Level Authorization (BFLA) — Accessing admin functions as regular user
• API6: Unrestricted Access to Sensitive Business Flows — Automating flows meant for humans
• API7: Server-Side Request Forgery — Making the server request unintended resources
• API8: Security Misconfiguration — Default configs, verbose errors, CORS misconfigurations
• API9: Improper Inventory Management — Shadow APIs and undocumented endpoints
• API10: Unsafe Consumption of Third-Party APIs — Trusting external API responses without validation

Authentication Testing Checklist

OAuth 2.0 / OIDC

• [ ] Verify authorization code flow cannot be intercepted (PKCE enforcement)
• [ ] Test for token leakage in URL fragments and referrer headers
• [ ] Confirm state parameter prevents CSRF attacks
• [ ] Check that redirect URIs are strictly validated (no open redirects)
• [ ] Verify scope enforcement — request elevated scopes and confirm denial
• [ ] Test token revocation actually invalidates access

JWT Security

• [ ] Attempt algorithm switching attacks (RS256 → HS256)
• [ ] Test for acceptance of "alg": "none"
• [ ] Verify signature validation is enforced (modify payload, keep signature)
• [ ] Check token expiration enforcement (expired tokens rejected)
• [ ] Test for JWK injection in token headers
• [ ] Confirm sensitive data isn't stored in JWT payload (tokens are base64, not encrypted)

API Keys

• [ ] Test key rotation — old keys should be invalidated
• [ ] Verify keys aren't exposed in client-side code or URLs
• [ ] Check that key permissions follow least-privilege
• [ ] Test key scope enforcement across different endpoints
• [ ] Confirm keys aren't logged in server access logs

Authorization Testing Checklist

BOLA (Broken Object Level Authorization)

• [ ] Access resources using IDs belonging to other users
• [ ] Test with sequential, predictable IDs (increment/decrement)
• [ ] Swap UUIDs between authenticated users
• [ ] Test indirect object references (nested resources: /users/A/orders/B)
• [ ] Verify authorization on all CRUD operations (not just read)

BFLA (Broken Function Level Authorization)

• [ ] Access admin endpoints with regular user credentials
• [ ] Test HTTP method switching (GET → PUT/DELETE on same endpoint)
• [ ] Attempt to access internal/debug endpoints (/api/admin, /api/internal)
• [ ] Test privilege escalation via parameter manipulation (role=admin)
• [ ] Verify endpoint access controls match documented API permissions

Rate Limiting & Resource Controls

• [ ] Identify endpoints without rate limiting (especially auth endpoints)
• [ ] Test for bypass via header manipulation (X-Forwarded-For, X-Real-IP)
• [ ] Verify rate limits apply per-user, not just per-IP
• [ ] Test resource-intensive endpoints for DoS potential (complex queries, large payloads)
• [ ] Check pagination limits — request page_size=1000000
• [ ] Verify file upload size restrictions
• [ ] Test for GraphQL query depth/complexity limits

Input Validation Checklist

• [ ] SQL injection in query parameters, headers, and JSON body fields
• [ ] NoSQL injection (MongoDB operators: $gt, $regex, $where)
• [ ] Command injection in parameters that interact with the OS
• [ ] SSRF in URL parameters (internal IP ranges, cloud metadata)
• [ ] XXE in XML-accepting endpoints
• [ ] Path traversal in file-related parameters
• [ ] Mass assignment — send unexpected fields (isAdmin, role, price)
• [ ] Type confusion — send arrays where strings expected, objects where arrays expected
• [ ] Unicode/encoding bypass attempts
• [ ] Oversized payloads and deeply nested JSON

Transport & Configuration

• [ ] Verify TLS enforcement (no HTTP fallback)
• [ ] Check CORS configuration (overly permissive origins)
• [ ] Test for verbose error messages leaking internals
• [ ] Verify security headers (Content-Type enforcement, X-Content-Type-Options)
• [ ] Check API versioning — old versions may lack security fixes
• [ ] Test for exposed documentation endpoints (Swagger UI in production)
• [ ] Verify that debug/development endpoints are disabled

How ZeroSight360 Approaches API Pentesting

Our API security assessments follow a structured methodology:

1. Discovery & Mapping: We enumerate all API endpoints, including undocumented shadow APIs, through traffic analysis, documentation review, and fuzzing.

2. Authentication Analysis: We test every authentication mechanism for weaknesses — from token generation to session management to MFA bypass.

3. Authorization Deep-Dive: We perform systematic BOLA and BFLA testing across all resources and privilege levels, mapping the complete authorization matrix.

4. Business Logic Testing: Beyond technical vulnerabilities, we test for abuse of business flows — pricing manipulation, workflow bypass, and race conditions.

5. Comprehensive Reporting: Every finding includes reproduction steps, risk rating, and specific remediation guidance tailored to your technology stack.

Conclusion

API security requires systematic testing across authentication, authorization, input validation, and business logic. Use this checklist as a starting point, but remember that real-world APIs have unique business logic that requires creative testing beyond standard checks. Regular assessments combined with automated scanning provide the best coverage for protecting your API attack surface.