API penetration testing

• You are opening an API to customers or integration partners.
• A release introduces user roles, endpoints, versions or new ways to share data between customers.
• The API handles orders, customer records or another workflow where an unauthorised change would matter.

Agree the API versions, endpoints, identities and business workflows to examine. A customer, a partner integration and an administrator may all call the same service with different permissions.

• Whether a request can read or change another user’s record, or retrieve fields that the account should never see.
• Whether a lower-privilege role can call an administrative function directly, and how the API checks credentials or tokens.
• How agreed endpoints handle unexpected input, older versions and repeated requests. Teams agree safe request limits before testing sensitive business flows.

• API documentation such as an OpenAPI definition or collection, base URLs and details of supported versions.
• Test identities for the relevant roles and tenants, sample records and expected access rules.
• A list of downstream systems, safe test endpoints and time or request limits.

For an invoice ownership check, create two test accounts in separate tenants and one fictional invoice belonging to tenant A. Using the same invoice ID, the owner’s request should return its invoice and the account from tenant B should receive no invoice data. Describe those expected outcomes when scoping the test. Exchange credentials through the agreed secure channel.

Agreed boundaries

Use test tenants, synthetic records and sandboxed integrations wherever possible. Agree rate limits and exclude actions that could send a real notification, debit a customer or place a live order.

Findings identify the affected endpoint, caller role and business action. Developers receive a safe way to reproduce the issue, the expected and observed behaviour, the likely impact and a recommended fix.

Follow-up

Repeat the failing request and check that the authorised owner can still use the endpoint. Vambrace offers free retests of vulnerabilities found for 12 months.