API testing evaluates whether an API behaves as intended and resists exploitable behavior. Security testing complements threat modeling and best practices by providing confidence that implementations are not vulnerable to attacks. section 12.0
A practical API security testing strategy combines:
- Penetration testing for expert, API-specific assessment; its results are strong but the work is expensive, slow, and difficult to scale. section 12.0
- Automated tools for fast malicious-injection and configuration checks; they depend on good configuration and can miss business-logic flaws. section 12.0
- Custom tests that target API-specific flaws, including authorization failures and unexpected business-flow behavior. section 12.0 section 12.5
Testing coupon abuse
A pytest test registers one student to obtain a voucher, authenticates as another student, and submits that voucher to a course-registration endpoint. The expected response is 403. A successful registration exposes missing user-based access control and may combine with a BOLA flaw. Repeating similar unit tests on every code change helps detect regressions and unexpected behavior. section 12.5
