Why API Pentests Need Multiple Users and Tenants
Why same-role peers, cross-tenant accounts, privileged roles and lifecycle states are required to prove API authorization coverage.
Resource topic
Web, API & Application Security
Technical guidance for web applications, REST and GraphQL APIs, authentication, authorization, business logic and microservices.
13 published resources
Start here
Featured Web, API & Application Security resource
Published guidance
More in Web, API & Application Security
How Manual Pentesters Find API Business-Logic Bugs
How manual testers model invariants and vary identity, state, sequence, quantity, timing and channel to find API workflow abuse.
Source-Assisted vs Runtime-Only API Penetration Testing
When source access improves API pentest coverage, how to protect code, and why final findings and retests still require runtime evidence.
When to Choose API Penetration Testing Over a Security Review
A buyer decision guide for choosing API penetration testing, a general security review, or a combined assessment based on the evidence required.
Map Shadow APIs and Orphaned Services Before a Pentest
Reconcile DNS, certificates, gateways, deployments, clients, telemetry and ownership to find and govern hidden API exposure.
Scope GraphQL Security Testing Across Resolvers and Authorization
How to test GraphQL schemas, resolvers, field authorization, mutations, complexity, caching, federation and downstream trust.
Should a Pentest Cover the API Gateway or Every Microservice?
A decision framework for testing API gateways, direct microservice routes, downstream authorization, parsing differences and service identity.
How to Test Shadow APIs and Undocumented Endpoints
Discover shadow APIs from clients, traffic and infrastructure evidence, confirm ownership, validate reachability and test authorization before reporting impact.
How to Pentest OAuth, SSO, Refresh Tokens and Fallback Login Paths
An identity-state testing model for OAuth and SSO flows, token validation, refresh, revocation, account linking, recovery and fallback bypasses.
Should an Application Pentest Include Source-Code Review?
When focused source review improves an application pentest, what runtime testing proves, how to combine them and how to state coverage accurately.
How Manual Pentesters Test Business Logic Beyond DAST
How skilled testers model abuse cases and manipulate workflow sequence, state, actors, values, timing, concurrency and alternate interfaces.
What Evidence Proves a BOLA or IDOR Finding Is Real?
Prove broken object-level authorization with controlled identities, object ownership, request pairs, protected outcomes, attacker preconditions and retest criteria.
How to Penetration Test Microservices, Internal APIs and Background Jobs
An architecture-led approach to testing service identities, internal APIs, queues, workers and cross-service attack paths beyond the public UI.
No resources match that search.
Try a broader security term or browse another topic.