SWSAM services
API security testing
Discuss API testing around authentication, authorisation, data handling and application logic. Agree the environment, access and rules of engagement before testing begins.
Discuss your assessment scopeDefine the API boundary
Identify the APIs, user roles and business operations you want reviewed. Include relevant integrations and the environments available for testing. Confirm which systems are excluded and who can authorise the assessment.
Agree the testing approach
The approach depends on the project. Discuss documentation, test accounts, access and permitted activities rather than assuming that every assessment uses the same level of information.
Make findings useful to your team
Agree how evidence, impact and remediation will be explained, who will review the results and how retesting fits the engagement. Keep the expected report and follow-up responsibilities explicit in the scope.
Prepare your testing enquiry
Bring an outline of the API, important user roles, the reason for testing and any operational restrictions. Do not send production credentials, tokens or customer data through this form.
Reference: OWASP — API Security