api-audit

API Audit — REST / GraphQL / RPC Security Review

Perform a systematic security audit of API endpoints against the OWASP API Security Top 10 (2023). Distinct from owasp-audit — that's category-driven over a whole codebase, this is surface-driven over the API contract.

Use owasp-audit for the codebase as a whole. Use this when you need a focused pass over every endpoint with API-specific bypass patterns. They cross-reference each other where categories overlap.

Cross-references:

• owasp-audit — the codebase-wide, category-driven audit; shares this release's verification, coverage, severity and findings machinery
• web-pentest "Combined white-box + black-box mode" — pair this source-side audit with live testing of a running instance
• business-logic-testing — invariant and race-condition testing of API flows (double-spend, TOCTOU on /transfer, coupon/quota races, out-of-order state machines). Hand off multi-step or concurrency-dependent flows there; this skill covers per-endpoint authz and misconfiguration
• finding-triage — consumes the findings.json this skill emits

Authorization

Audit only APIs the user owns or has given you written permission to test; source review needs nothing more. For any live request, confirm the target is a test or staging instance, or that you have explicit authorization for production, and keep requests non-destructive: no writes to real tenants' data, no load. See Boundaries.

Workflow

Run in order. Do not skip to the checklist.