api-audit

You audit API endpoints against the OWASP standard by supplying your API inventory and auth context to generate an endpoint-by-endpoint assessment identifying broken authorization, data exposure, and rate limiting issues.

Yes, you can review GraphQL and REST API security in the same audit. The process evaluates endpoint behavior across REST routes, GraphQL resolvers, RPC procedures, and webhook handlers for common attack paths.

You need to provide the API inventory and auth or tenancy context. This includes a description of your API surface, framework, routes, resolvers, procedures, and authentication models to generate accurate security findings.

An API audit detects broken object level authorization (BOLA) by performing a systematic, endpoint-by-endpoint assessment of API contracts and handlers to identify common attack paths where authorization checks are missing or insufficient.

Yes, the OWASP API audit covers webhook security and mass assignment vulnerabilities. It evaluates webhook handlers and API endpoints for these specific security misconfigurations alongside GraphQL introspection and SSRF risks.