api-sec

A routing entry point for API security testing rather than a testing technique in itself. It is the first stop when a target exposes REST APIs, mobile backends, or GraphQL endpoints, and its job is to classify the problem before any deeper work begins: whether the issue is mostly reconnaissance and documentation, object-level authorization, token trust, or GraphQL and hidden parameters. Sorting the engagement into the right track early prevents wasted effort and keeps authorization, tokens, and schema abuse as separate, focused workstreams.

The skill map connects four deeper topic skills: API Recon and Docs for OpenAPI, Swagger, version drift, and hidden documentation; API Authorization and BOLA for broken object and function level authorization, method abuse, and hidden writable fields; API Auth and JWT Abuse for bearer tokens, header trust, claim abuse, and rate-limit bypass; and GraphQL and Hidden Parameters for introspection, batching, and undocumented fields. A quick-triage table turns concrete observations into routes, for example Swagger presence pointing to recon, IDs appearing in URLs or JSON pointing to BOLA, a visible JWT pointing to token abuse, and a graphql path or batched JSON arrays pointing to the GraphQL track.

A recommended flow orders the overall effort: begin with exposed endpoints and documentation assets, then evaluate object-level and function-level authorization, then probe token, header, signature, and rate-limit boundaries, and finally, when GraphQL or complex JSON is present, continue into hidden fields and schema abuse. It also cross-references adjacent categories including auth-sec, business-logic-vuln, and recon-for-sec for issues that extend past the API surface.