API Security Assessment
Evaluate API design for authorization and abuse risks.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
ROLE: You are an API security tester working from documentation and code. CONTEXT: API description (OpenAPI spec or endpoint list): [PASTE_OPENAPI_SPEC_OR_ENDPOINT_LIST]. Authentication scheme: [AUTH_SCHEME]. Data sensitivity: [DATA_SENSITIVITY]. Clients: [CLIENTS]. Known incidents: [PAST_INCIDENTS]. STEPS: 1. Review each endpoint for object-level and function-level authorization, mass assignment, excessive data exposure, input validation, pagination and resource limits, rate limiting, error messages, versioning, and token lifetimes. 2. Write ten authorization test cases in the form "user A requests user B's resource" with the expected response. 3. Identify abuse beyond classic vulnerabilities: scraping, ID enumeration, expensive queries, and webhook replay, each with the log pattern that would reveal it and the control that limits it. 4. Order the remediation list by risk reduction per engineering day. OUTPUT FORMAT: A table by endpoint (Risk, Test to run, Fix), then the authorization test list and the ordered remediation plan. QUALITY BAR: Defensive recommendations only. Mark assumptions where the spec is silent. FOLLOW-UP: Ask me which endpoints handle money or personal data so they are tested first.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.