API testing methodology (work top to bottom)

Confirm scope first (tradecraft-scope-roe). Each phase links to the skill that goes deep — load it, work its cheatsheet.md where present, and don't mark a phase failed until you've covered it (house rule: fuzz every input/context/encoding, blind/OOB). This is your coverage map.

1 · Discover & map the surface

• Find the API: /api, subdomains, JS files (recon-js-analysis), mobile/SPA traffic (recon-content-discovery)
• Grab the spec: swagger.json / openapi.json / GraphQL introspection / .proto — enumerate every endpoint, method, param
• Note auth model (Bearer/JWT/API key/cookie/mTLS), versions (/v1,/v2), and content types
• Map roles: create two accounts (and an unauth client) — you need them for access-control tests

2 · Authentication

• Token flaws — JWT alg/kid/key confusion (web-auth-jwt), API-key leakage/predictability
• Auth attacks — credential stuffing, weak/OTP flows, token not expiring/rotating (api-auth-attacks)
• Unauthenticated endpoints that shouldn't be

3 · Authorization (the #1 API bug class — go deep)

• BOLA/IDOR — swap object IDs between the two accounts on every object-taking endpoint (api-bola, web-idor)
• BFLA — call admin/privileged functions as a low-priv user; try hidden methods (PUT/DELETE/PATCH)
• Path/verb tampering, X-Original-URL/method override, GraphQL field-level authz

4 · Input handling & injection

• Injection across params, JSON bodies, headers: SQLi (web-sqli), NoSQL (api-mongo-agg-facet-bypass), command (web-command-injection), SSTI (web-ssti)
• SSRF via URL params / webhooks / "fetch from URL" (web-ssrf), XXE on XML endpoints (web-xxe)
• Mass assignment — inject extra fields (role,isAdmin,price) (api-mass-assignment)

5 · Data exposure & business logic

• Excessive data exposure — endpoints returning more fields than the UI shows (PII, internal flags)
• Business-logic abuse — price/quantity tampering, negative values, replay, race conditions (web-race-conditions, web-business-logic)
• Mass assignment → privilege/state change; parameter pollution (web-http-parameter-pollution)

6 · Rate limiting & resource consumption

• Missing/bypassable rate limits (web-rate-limit-bypass) — brute, enumeration, cost
• Unbounded queries / pagination abuse; GraphQL depth/alias/batch amplification

7 · Protocol specifics

• GraphQL — introspection, batching, injection, field authz (api-graphql)
• gRPC — reflection, message tampering (api-grpc)
• REST/SOAP — verb tampering, content-type confusion, version drift (api-versioning); fuzz systematically (api-fuzzing)

8 · Before you report

• Re-prove each finding from a clean session; anonymise data (reporting-triage-validation)
• Score it (reporting-cvss-scoring), then write it up (reporting-bug-bounty-writeup)

Coverage bar

Every endpoint × method exercised; BOLA/BFLA tried across accounts on every object; injection fuzzed on every input; rate-limit and business-logic checked. A phase is failed only after that — else open.