domains / families / security / api-security

api-security

authentic

Authorized security assessment of REST, GraphQL, WebSocket, and SOAP APIs: discovery, authentication and authorization flaws (BOLA/IDOR, JWT/OAuth), rate-limit testing, and a structured multi-phase methodology.

When to use

• An authorized assessment covers API endpoints and you need a structured discovery-to-report workflow.
• Testing API authentication, authorization, or rate-limiting behavior within an approved scope.

When not to use

• Only run against APIs you are explicitly authorized to test.
• Some checks are intrusive; prefer non-production mirrors when available.

Skill page

Source