thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

API Security Testing

Testing APIs for authentication, authorization, input handling, rate limiting and business logic flaws, guided by the API specification.

Definition

API tests use OpenAPI or GraphQL schemas to enumerate endpoints and should test each one with multiple roles for BOLA and BFLA. Traditional DAST crawlers miss many API endpoints, so specification-driven and authenticated testing is essential.

Example

A test suite replays every endpoint with a second user's token to detect BOLA.

Exam tip

Authorization testing with multiple user roles is the most important API test.

Related terms