Blog
Guides, tutorials, and comparisons for API testing.
Security
How to Test APIs for Authorization Issues (IDOR)
Learn how to test API authorization, detect IDOR vulnerabilities, and verify that users can only access and modify resources they are authorized to use.
How to Test API Authentication
How to verify login, tokens, and session handling are implemented correctly — the companion piece to authorization testing.
BOLA vs IDOR: What's the Difference?
A closer look at how Broken Object Level Authorization and Insecure Direct Object Reference relate, and where the terms diverge.
API Authorization Testing Checklist
A standalone, printable checklist for verifying object-level and function-level authorization across an API surface.
How to Test API Role-Based Access Control
Testing function-level authorization across roles like Customer, Support Agent, Manager, and Administrator.
OWASP API Security Top 10
A walkthrough of the current OWASP API Security Top 10 list and how each risk applies to API testing.
Rate Limit Testing for APIs
How to verify your API enforces rate limits correctly, and what to check for false positives and negatives.
API Security Testing: Covering the OWASP API Top 10
What API security testing covers and how to catch the OWASP API Top 10 issues before they reach production.
Guides
Boundary Testing for APIs
Testing the edges of your input space, min/max values, empty payloads, type mismatches, not just the happy path.
Testing APIs from an OpenAPI Spec
How to go from an OpenAPI/Swagger definition to a running test suite with schema validation.
The Complete API Testing Guide
A pillar guide tying together fundamentals, tooling, and workflow for teams building out an API testing practice.
Tools for API Testing: An Overview
A roundup of the tool categories teams use for API testing, from request builders to security scanners.
The API Testing Checklist
A pre-release checklist covering functional, security, performance, and contract checks for any API.
How to Perform API Testing: A Step-by-Step Guide
A practical walkthrough for testing an API from scratch — importing or building requests, adding assertions, chaining calls, and wiring it into CI.