API Security Testing Checklist: Find Shadow APIs First

List every API your organization exposes, then look for the ones that are not on the list:

• Old versions. /v1/ stays live after /v3/ ships, often without the newer checks.
• Shadow APIs. Endpoints used by a mobile app or an admin screen that were never documented.
• Documentation left open. Swagger and OpenAPI pages, GraphQL introspection and Postman collections that describe every call to anyone who asks.
• Test and staging hosts reachable from the internet with production data.
• Third-party APIs your product calls and trusts.

Testers find these from the mobile app, the web front end, public repositories, DNS records and old documentation. Every endpoint found is added to scope, with your agreement.

Broken authorization is the leading API problem, and the OWASP API Security Top 10 from 2023 is still the current edition. Three of its entries cover it: object-level authorization, broken function-level authorization and broken object property-level authorization. Test them like this:

1. Sign in as user A and note the identifiers in each request.
2. Replay the request as user B, and with no login, and see whether the data comes back.
3. Call administrator and internal functions with an ordinary user's token.
4. Send extra fields in write requests, such as a role, a price or an owner, and check whether the server accepts them.

This must be done by hand with at least two accounts per role, because a scanner does not know which record belongs to whom.

• Are tokens signed with a strong algorithm and verified on every request?
• Do they expire, and does logout invalidate them on the server?
• Is there a limit on login, password reset and one-time passcode attempts?
• Are API keys scoped, rotated and kept out of mobile app packages?

An API with correct permissions can still be abused at volume. Check rate limits on every route that sends a message, creates an account, applies a coupon or reveals data. The 2023 list names "unrestricted access to sensitive business flows" for this reason: the endpoint works as designed, and the harm comes from using it ten thousand times. Look for resource limits too, such as page size, upload size and expensive queries.

Compare what the response contains with what the screen shows. APIs often return full records and rely on the app to hide fields. Look for personal data, internal identifiers, tokens and debugging information in responses and error messages.

GraphQL needs its own checks: introspection, deeply nested queries, batching to get around rate limits, and authorization on every resolver. Webhooks need signature checks and replay protection. The 2023 list also covers unsafe consumption of other APIs, so check what your server does with a response from a partner or vendor.

Many products now expose an AI assistant, or let an AI agent call their functions through a tool server such as MCP. OWASP's GenAI project has published a Top 10 for LLM applications, a Top 10 for agentic applications in December 2025 and an MCP Top 10. Behind the novelty, the first questions are the old ones: who is allowed to call this, with what scope, and what can it reach? An assistant that can read any customer's order because it uses a service account is broken access control with a chat window. Test these endpoints like any API, and add prompt-injection and tool-permission checks on top.

Testers use Burp Suite, Postman, ZAP, Nuclei and ffuf for discovery and replay, plus custom scripts. Scanners and AI-assisted features find missing headers and known patterns. Deciding whether user B should see that record takes someone who understands your business.

1. Export your OpenAPI or Postman files and mark which are current.
2. List every host and version in production.
3. Prepare two test users per role and one administrator.
4. Decide which environment the tester uses and when.
5. Name the owner who can answer questions about each service.

Our engineers test your APIs by hand, with documentation and without it. See API security testing and our API testing cost guide, or request a scoping call.

Facts in this article were checked on 4 November 2026 against these primary sources:

• OWASP API Security project
• OWASP Top 10 for Agentic Applications for 2026
• OWASP MCP Top 10
• OWASP Top 10 for LLM applications