Test and operate APIs
Write an API security matrix
Test every route across identity, role, object relationship, input boundary, rate limit, and expected security event.
8 minute lesson
API security tests need more than one happy-path token. Build a matrix that changes one security condition at a time.
Include anonymous, expired, revoked, low-privilege, wrong-tenant, and administrative identities. Test another user’s object, hidden properties, alternate methods, batch requests, oversized input, and repeated calls. Verify stored state and events, not only status codes.
A 403 alone does not prove safety if the invoice changed before the response. The matrix must check identity, outcome, stored state, and the expected security event.
Prioritize cells by potential harm instead of automating every permutation first. Cross-tenant writes and money movement deserve stronger evidence than a harmless malformed optional field.
Automate the highest-impact rows for two users, two tenants, an expired token, and an oversized body. Save assertions for response, database state, and audit event, then make one policy fail and prove the test catches it.
Lesson completed