API Penetration Testing Checklist: What an API Test Should Cover

An API penetration testing checklist should cover your endpoint inventory, authentication, object- and function-level authorization, data exposure, rate limits, business flows, input handling, configuration and evidence for every finding. Mapped to the OWASP API Security Top 10 (2023), it shows whether a test plan reaches every endpoint with every role.

How much of the list fits into one test depends on the number of endpoints, roles and API types (REST, GraphQL, webhooks). At Pentestica, a standard web application or API penetration testing engagement costs $2,500 to $5,500, is quoted in tester-days and typically runs 1 to 3 weeks plus a few days for the report.

What to prepare before the API test starts

Testers need a specification, accounts in every role and a defined environment.

• API description: An OpenAPI file, GraphQL schema, exported collection or recorded traffic capture.
• Two accounts per role: Enough to test one user against another in every role.
• Access to the environment: Hostnames, VPN or certificates, and tester IP addresses on the allowlist.
• Off-limits actions: Endpoints that trigger payments or irreversible actions, traffic limits and who can pause testing.

PCI SSC guidance strongly encourages organizations to supply credentials so the tester can assume the required roles. Agree the scope in writing, along with the rules of engagement for testing windows and contacts; the general penetration testing checklist covers the project steps.

Authentication and authorization checks

This part of an API security testing checklist needs two accounts side by side.

• Object level authorization (API1:2023): Swap object IDs between accounts. A finding is user A’s request returning user B’s record.
• Authentication (API2:2023): Token validation, expiry and refresh, plus unlimited guesses on login or one-time codes.
• Object property level authorization (API3:2023): Fields the role shouldn’t see, and mass assignment: a field such as a role that the regular client never sends but the API still accepts.
• Function level authorization (API5:2023): Admin routes and switched HTTP methods from a regular role, for example a DELETE on an admin route that returns 200 for a regular account.

If the API serves your front end, test sessions and roles together with web application testing.

Abuse, input and configuration checks

These checks ask whether the API can be overused, fooled or reached through forgotten parts.

• Unrestricted resource consumption (API4:2023): Request rates, timeouts, upload size, records per page and spending limits on paid services.
• Unrestricted access to sensitive business flows (API6:2023): Purchases, bookings or posts automated at machine speed.
• Business logic: Checkout, password reset and other multi-step flows called out of order.
• Server side request forgery (API7:2023): Endpoints that fetch a remote resource from a user-supplied URL. Features that call user-supplied URLs need the final destination checked, not just the first one, as our webhook SSRF case study shows.
• Injection: Parameters and body fields passed to databases or commands; the 2023 list has no separate category for it.
• Security misconfiguration (API8:2023): Permissive CORS and error messages with stack traces.
• Improper inventory management (API9:2023): Deprecated versions, exposed debug endpoints and non-production hosts still online.
• Unsafe consumption of APIs (API10:2023): Third-party API data trusted more than user input.

Evidence, reporting and retest

The last part of an API pentest checklist concerns the report: every finding needs evidence developers can reproduce.

• Location: The affected endpoint and method.
• Proof: Full request and response, plus a severity rating with reasoning.
• Impact and fix: Business impact and step-by-step remediation.

Also ask which account or role produced each finding. Our reports come as an Executive Summary for management and a Technical Report for engineers. Critical findings are reported during testing, and a retest is available after fixes. Compare any offer with a sample pentest report, or see an API test on a fintech platform.

Sources: OWASP API Security Top 10 2023; PCI SSC Penetration Testing Guidance v1.1 (section 4.2.1).