API reconnaissance basics: building a map before you test

Effective API testing starts with reconnaissance. How to enumerate endpoints, understand auth, and model the API before probing for flaws.

On this page

Testing an API blind is slow and error-prone. A short reconnaissance phase turns guesswork into a map you can reason about.

Collect the specification

If an OpenAPI or GraphQL schema is available, start there, it lists endpoints, parameters, and expected types. When no specification exists, reconstruct one from client traffic, mobile app bundles, and error messages.

Understand authentication

Identify how the API authenticates requests: session cookies, bearer tokens, API keys, or mutual TLS. Note where tokens are issued, how they are scoped, and how they expire. Authorization flaws are easiest to find once you understand the identity model.

Model the objects

List the resource types the API exposes and how they reference one another. Object relationships are exactly where authorization and injection issues tend to live, so a clear object model directs the rest of your testing.

Sample content for development and testing. Assess only systems you are permitted to test.