Secure Your APIs with Comprehensive Testing

Runs REST and GraphQL API security testing as a fixed 7-phase workflow, each phase delegating to a named specialist skill rather than testing everything itself. Phase 1 discovers API endpoints, methods, parameters, and data flows by invoking the api-fuzzing-bug-bounty and scanning-tools skills. Phase 2 tests authentication - API keys, JWT tokens, OAuth2 flows, token expiration, and refresh tokens - via broken-authentication and api-security-best-practices. Phase 3 tests authorization - object-level, function-level, role-based access, privilege escalation, and multi-tenant isolation - via idor-testing. Phase 4 fuzzes input validation, covering SQL injection, NoSQL injection, command injection, and XXE injection, via api-fuzzing-bug-bounty and sql-injection-testing. Phase 5 tests rate limiting: headers, brute-force protection, resource exhaustion, and bypass techniques, via api-security-best-practices. Phase 6 tests GraphQL-specific surface - introspection, query depth, query complexity, batch queries, and field suggestions - via api-fuzzing-bug-bounty again. Phase 7 audits error handling: error message content, information disclosure, stack traces, and logging, again via api-security-best-practices. Each phase ships a copy-paste prompt template naming the exact skill to invoke, so the workflow can be driven phase by phase without re-deriving which specialist skill covers which concern. Every phase follows the same shape - a short set of named actions (typically five per phase, like enumerating endpoints, documenting methods, and mapping data flows in discovery) paired with the skills to invoke for each - which keeps the workflow predictable even as the underlying security concern changes from phase to phase.

Use it when testing REST API security, assessing GraphQL endpoints, validating API authentication, testing API rate limiting, or doing bug-bounty-style API testing specifically - the workflow is API-focused, not general web application security testing. An eight-item checklist anchors what secure means for the API under test: authentication working, authorization enforced, input validated, rate limiting active, errors sanitized, logging enabled, CORS configured, and HTTPS enforced, and a separate four-item quality gate requires every endpoint tested, every vulnerability documented, remediation provided, and a report generated before the workflow is considered complete. Related bundles cover adjacent scope: security-audit for general security auditing, web-security-testing for broader web application testing, and api-development for the non-security side of API work.

Takes a REST or GraphQL API to test; produces a documented set of findings across authentication, authorization, input validation, rate limiting, GraphQL-specific issues, and error handling, checked against the security checklist, plus a final report with remediation guidance.

Security testers and bug bounty hunters who want a structured, phase-by-phase API security assessment that delegates each concern to the right specialist skill instead of testing everything ad hoc.