API Penetration Testing Checklist: How to Secure REST & GraphQL Endpoints

Why Traditional Web Scanners Miss API Vulnerabilities

Standard web scanners look for surface-level flaws like reflected Cross-Site Scripting (XSS) or basic missing headers. However, API security risks primarily center around Broken Object Level Authorization (BOLA) and complex business logic flaws.

Since APIs operate without a visual user interface, testing requires intercepting, manipulating, and replaying raw HTTP requests to evaluate how backend servers handle unauthorized state changes or data requests.

The API Penetration Testing Checklist

A comprehensive API pen test follows a structured framework aligned with the OWASP API Security Top 10:

1. Information Gathering & Documentation Analysis

• Inspect API Specs: Analyze OpenAPI/Swagger, Postman collections, or GraphQL schemas to map all accessible endpoints, parameters, and accepted HTTP methods (GET, POST, PUT, DELETE).
• Identify Undocumented Endpoints: Search for hidden, shadow, or legacy API versions (e.g., /api/v1/ vs. /api/v2/) that may lack updated security controls.

2. Authentication & Session Management

• JWT Validation: Test JSON Web Tokens for weak signature algorithms (e.g., alg: none), key confusion attacks, or sensitive data exposed in the payload.
• Token Invalidation: Verify that OAuth tokens or API keys properly invalidate upon logout or expiration.
• Rate Limiting: Test endpoints (such as /login, /reset-password, or /mfa/verify) for missing rate limits to prevent brute-force attacks and resource exhaustion.

3. Authorization & Access Control (BOLA / BFLA)

• Broken Object Level Authorization (BOLA): Swap object identifiers (e.g., changing /api/users/1001/profile to /api/users/1002/profile) using a low-privileged user token to verify if another user's private data is accessible.
• Broken Function Level Authorization (BFLA): Attempt to call administrative or privileged endpoints (e.g., /api/admin/users/delete) using a standard user account context.

4. Data Exposure & Business Logic

• Excessive Data Exposure: Inspect API responses to ensure the backend does not return full database records, relying on the frontend to filter out sensitive fields.
• Mass Assignment / Parameter Pollution: Inject unexpected properties into POST or PUT JSON payloads (e.g., adding "is_admin": true) to test if backend models automatically bind input parameters.
• Input Injection: Test parameters for SQL Injection, NoSQL Injection, Command Injection, and Server-Side Request Forgery (SSRF).

5. GraphQL Specific Security (If Applicable)

• Introspection Security: Verify if GraphQL introspection queries are restricted in production environments to prevent schema disclosure.
• Query Depth & Batching Attacks: Test for missing query depth limits and batching protections to prevent Denial of Service (DoS) attacks via nested or cyclic queries.

Essential Tools for API Penetration Testing

• Burp Suite / OWASP ZAP: Essential proxy tools for intercepting, modifying, and replaying API traffic.
• Postman / Insomnia: Used to organize, structure, and execute API endpoints against target environments.
• Kiterunner: Designed specifically for discovering hidden API endpoints and routing paths.
• jwt_tool: Specialized toolkit for testing and exploiting JSON Web Token vulnerabilities.

Core Business Benefits of API Pen Testing

• Prevents Massive Data Leaks: Catches authorization flaws before attackers can scrape underlying databases through automated endpoint harvesting.
• Ensures DevSecOps Alignment: Identifies design and logic flaws early in the software development lifecycle (SDLC) before production deployment.
• Meets Regulatory Compliance: Satisfies mandatory API security assessment guidelines across PCI DSS, ISO 27001, and GDPR.