What this prompt does
This prompt builds a hands-on API security testing playbook organized around the OWASP API Security Top 10 (2023). You describe the [api_description], [api_architecture], [auth_mechanism], [authz_model], [endpoint_count], and [data_sensitivity], and it generates concrete test cases — with runnable curl/httpie commands — for each category, plus a testing toolkit setup and a reporting template.
The structure works because it follows the real exploitation order: it starts with Broken Object Level Authorization (BOLA) and Broken Authentication, which is where most real API breaches actually happen, then works through mass assignment, resource consumption, function-level authorization, SSRF, and misconfiguration. By keying tests to your [authz_model] and [auth_mechanism], the JWT, IDOR, and privilege-escalation cases target your actual setup. The [automation_tool] slot turns the playbook into a regression suite you can wire into CI.
When to use it
- You've built an API and want to test it against the OWASP API Top 10 before or after launch.
- You need runnable curl/httpie cases, not an abstract checklist, to actually probe BOLA and auth flaws.
- You're handling sensitive data (
[data_sensitivity]like PII or PCI scope) and need documented security testing. - You want a Postman/Newman or
[automation_tool]regression suite wired into CI to guard every deploy. - You're reviewing a multi-tenant API where object-level authorization is the highest risk.
- You need a CVSS-scored reporting template with reproduction steps for findings.
Example output
You get a category-by-category playbook: BOLA tests that swap object IDs across CRUD operations, broken-auth tests probing JWT algorithm confusion and token replay, mass-assignment and response-filtering checks, resource-consumption tests (rate limits, pagination abuse, ReDoS), function-level authorization tests, and SSRF/misconfiguration coverage — each with curl or httpie commands. It closes with a toolkit setup (Burp, Postman/Newman, your [automation_tool]) and a CVSS 4.0 reporting template with reproduction steps and remediation.
Pro tips
- Describe
[authz_model]precisely (RBAC, org-scoped, tenant isolation); the BOLA and privilege-escalation tests are built around it. - Specify your exact
[auth_mechanism]so the JWT and session tests match your token and refresh setup. - Set
[data_sensitivity]honestly — PCI or PII scope raises the priority of response-filtering and mass-assignment tests. - Use
[automation_tool]to get a regression script you can run in CI, not just one-off manual commands. - Only run these tests against systems you own or are authorized to test; the playbook is for defensive work.
- Start with BOLA and broken auth as the prompt orders them — that's where the highest-impact findings usually are.
