API Audit

API Audit — REST / GraphQL / RPC Security Review

Perform a systematic security audit of API endpoints against the OWASP API Security Top 10 (2023). Distinct from owasp-audit — that's category-driven over a whole codebase, this is surface-driven over the API contract.

Use owasp-audit for the codebase as a whole. Use this when you need a focused pass over every endpoint with API-specific bypass patterns. They cross-reference each other where categories overlap.

Scope the Audit

1. Inventory every API surface — REST routes, GraphQL resolvers, tRPC procedures, gRPC services, Server Actions, webhook handlers, internal RPC
2. Identify auth model — JWT, session cookies, API keys, mTLS, OAuth scopes
3. Identify the tenancy model — single-tenant, multi-tenant, row-level isolation
4. Map sensitive resources — user data, payments, files, admin functions

Audit Checklist

API1: Broken Object Level Authorization (BOLA)

The #1 API vulnerability by exploitation frequency. Every endpoint that accepts an object ID needs an explicit ownership check before reading or mutating.

• For each route that takes an ID parameter (/users/:id, /orders/:id, /projects/:id), verify a query like findFirst({ where: { id, userId } }) runs before any data access — not findById(id) then a separate check
• ORM relation traversal: posts.find(id).user.creditCard returns another tenant's card if the relation isn't guarded. Audit every .include, .with, includes, eager-loaded relation
• UUIDs are not access control. Sequential IDs make enumeration trivial; UUIDs only slow it down
• Predictable surrogate keys (slugs, public_ids) used as if they were unguessable
• Grep for: params.id, req.params.<id>, formData.get("<id>"), ORM .findById( / .find( without a where clause, GraphQL resolvers that take an id arg and call .findUnique

API2: Broken Authentication

• JWT with alg: none accepted by the verifier
• JWT secret comparison without crypto.timingSafeEqual / equivalent
• Refresh tokens that never rotate or have no revocation list
• Password reset that returns a token in the response body instead of mailing it
• API keys passed in URL query string (logged everywhere — access logs, CDN, proxies)
• Bearer-token compare against process.env.X without a presence check — when X is unset, "Bearer ${undefined}" is a valid literal
• Grep for: jwt.verify, jsonwebtoken, Bearer ${process.env, jwt.decode (without verify), verify.*alg

API3: Broken Object Property Level Authorization (BOPLA / BFLA / Excessive Data Exposure)

• API returns the whole DB row instead of a curated DTO — res.json(user) leaks password_hash, stripe_customer_id, internal flags
• Admin-only fields (role, is_verified, tenant_id) accepted on update endpoints from regular users — mass assignment
• GraphQL exposes admin-mutation fields without role-based field-level auth — mutation UpdateUser($id, $role) succeeds because the resolver only checks "is the user logged in"
• Grep for: res.json(<entity>) without explicit field projection, Object.assign(record, req.body), Mongoose findByIdAndUpdate(id, req.body), Drizzle .update().set(req.body), Sequelize update(req.body), GraphQL resolvers without role checks

API4: Unrestricted Resource Consumption

• No rate limit on auth endpoints (login, signup, password-reset, SMS-send, email-verify)
• No per-tenant quota on expensive operations (LLM calls, search, file processing, webhook fan-out)
• Page size unbounded — ?limit=10000000 returns 10M rows
• GraphQL query depth not capped — user { posts { user { posts { ... } } } } runs forever
• GraphQL query complexity not analyzed — single query that triggers N+1 against 100M rows
• Webhook handlers that re-trigger expensive work without idempotency

API5: Broken Function Level Authorization (BFLA)

• Auth check on the route but not on the handler — wildcard middleware misses a manually-mounted route
• "Admin-ish" endpoints reachable by changing POST /api/v1/users/me to POST /api/v1/users/<other_id>
• HTTP verb tampering — DELETE /admin/users/123 blocked, but POST /admin/users/123/delete succeeds
• Conditional auth based on req.user.role === "admin" where role is set from a header the client controls
• Sister-route gaps — PUT /:id is guarded but POST /:id/send writes the same row without the guard. Run sister-route audit (see owasp-audit)
• Grep for: every route handler — does it call an auth check explicitly, or rely on something upstream that may or may not match this route's path?

API6: Unrestricted Access to Sensitive Business Flows

• Endpoint allows automation that bypasses business intent — buying limited stock 1000× per second, reserving every seat in a venue, brute-forcing referral codes
• No CAPTCHA / proof-of-work / device fingerprint on flows that have business-rate constraints (signup, coupon redemption, vote, like)
• Anti-automation checks only on UI, not on the API

API7: Server-Side Request Forgery (SSRF)

• User-controlled URLs passed to server-side fetch — webhook URLs, image-fetch, SSO callback, PDF render, OG-scrape, link unfurling
• Allow-list checks only the hostname — see owasp-audit A10 for the full bypass matrix (9+ patterns including IPv4-mapped IPv6, trailing-dot, cloud metadata, encoded IPs)
• redirect: "follow" (default) on fetches with user-controlled URLs lets an attacker bounce through a 302 into the metadata service
• Webhook delivery from your domain to attacker URL — your server's IP is now their proxy

API8: Security Misconfiguration

• CORS Access-Control-Allow-Origin: * combined with Allow-Credentials: true (browsers refuse this; servers shouldn't ship it)
• CORS reflection of the Origin header without an allow-list — any origin gets allowed
• Verbose error responses leaking stack traces, query strings, internal IDs
• Default OpenAPI / GraphQL introspection exposed in production with full schema
• Missing security headers — see owasp-audit A05 for the full baseline values
• HTTP-only flag missing on session cookies