API Security Checklist

Eight checks against the flaws that dominate real API testing. Test object-level authorisation yourself by swapping IDs as a low-privilege user.

Before you test — Only test APIs you own or have explicit written permission to test. Unauthorised access is a criminal offence in Ireland under the Criminal Justice (Offences Relating to Information Systems) Act 2017.

Authorisation

Every endpoint checks that the caller owns or may access the specific object requested (test by swapping IDs).

Function-level authorisation is enforced server-side — admin routes reject non-admin tokens.

Mass assignment is prevented — clients can't set fields like 'isAdmin' by including them.

Data & tokens

The API returns only the fields the client needs, not the whole database row.

Authentication tokens expire and can be revoked.

Exposure & hygiene

Rate limiting protects login, search and any expensive endpoint.

No deprecated or undocumented endpoints are still live.

Errors don't leak internal detail; input is validated server-side.

Educational, not legal advice. Test only what you own or are authorised to test.
Full guide: API Penetration Testing © CyberLabs · cyberlabs.ie