Who this is for
Engineering teams shipping or maintaining a public or partner-facing API — REST or GraphQL — that handles authentication, user data, or business-critical operations. Especially relevant before a client, bank, or donor asks for a security attestation.
What's in the toolkit
- Authentication & session — token handling, session lifetime, multi-factor coverage.
- Authorization — object-level and function-level access control, tenant isolation.
- Input handling — injection surfaces, mass assignment, unsafe deserialization.
- Data exposure — excessive data in responses, verbose error output.
- Configuration — rate limiting, CORS policy, security headers, TLS.
How to use it
Run through each item against your actual deployed API, not your intended design. Automated scanners find candidates; this checklist is written for a human to confirm whether each one is actually exploitable in your context before you spend engineering time on it.
Go deeper
For a full permission-based, human-verified API security assessment, see Authorized Web & API Security Assessment. For OWASP Top 10 coverage across the broader web application, see OWASP Top 10 for Kenyan Web Applications.