A focused toolkit beats a sprawling one. For most API testing, a few composable tools cover the majority of work.
An intercepting proxy
The center of the toolkit is a proxy that lets you observe, modify, and replay requests. Everything else feeds into or out of it.
A capable HTTP client
A scriptable client turns a one-off finding into a repeatable check. Being able to express a request as code makes proofs of concept precise and shareable.
A schema-aware fuzzer
When you have an OpenAPI or GraphQL schema, a schema-aware fuzzer can generate malformed and boundary inputs far faster than you can by hand, surfacing weak input validation quickly.
Glue
The connective tissue, small scripts to diff responses across identities, enumerate identifiers, and summarize results, is where most of the leverage actually lives. Keep it in version control and reuse it across engagements.
Sample content created for development and testing.