api-sec-audit

/api-sec-audit

Audit API endpoints for security vulnerabilities against the OWASP API Security Top 10.

Trigger

Use this command when you need to assess the security of an API-exposing application. Appropriate for:

• New API development before deployment
• Security review of existing API services
• Evaluating third-party API integrations
• Compliance requirements for API security (PCI-DSS, SOC 2, HIPAA)

Input

Operates on the current project. Optionally accepts:

• API type: rest, graphql, grpc, websocket (auto-detected if not specified)
• Spec file: Path to OpenAPI/Swagger spec, GraphQL schema, or protobuf definitions
• Focus area: auth, authorization, injection, data-exposure, all (defaults to all)

Process

Phase 1: API Discovery

1. Identify the API framework (Express, FastAPI, Django REST Framework, Spring Boot, Rails API, NestJS, Gin, Echo, Fiber)
2. Parse route definitions to enumerate all endpoints with their HTTP methods
3. If OpenAPI/Swagger spec exists, cross-reference with code to find undocumented endpoints
4. For GraphQL, parse the schema (SDL or introspection query) to enumerate all queries, mutations, and subscriptions
5. Map middleware chains for each endpoint (authentication, authorization, validation, rate limiting)

Phase 2: OWASP API Security Top 10 Assessment

API1:2023 - Broken Object Level Authorization (BOLA)

• For every endpoint accepting a resource identifier (path param, query param, body field), verify the handler checks that the authenticated user owns or has access to that resource
• Look for patterns where object IDs from the URL are used directly in database queries without ownership filtering
• Check batch endpoints that accept arrays of IDs

API2:2023 - Broken Authentication

• Analyze credential validation logic for timing attacks, enumeration, and brute force susceptibility
• Check token generation for sufficient entropy
• Verify token validation checks signature, expiration, issuer, and audience
• Test password reset and account recovery flows