Prepare an automated API security assessment

Which problems can be checked

Supported scenarios include selected external configuration issues, cross-user and cross-tenant reads, role boundaries and configured token checks. Active SQLi, XSS and mutation scenarios require staging. Coverage depends on the selected profile, approved operations, data and request budget, not the size of an imported API schema.

Prepare the owner’s inputs

Provide the exact verified URL, environment, consent and a supported authorization method. For isolation, prepare A and B, their roles, known object paths and unique private markers. Use dedicated test accounts with minimal privileges and make sure the tokens remain valid for the intended run.

Primary sources: Primary reference 1

Continue: IDOR and BOLA: test access to another user’s data

Write down expected permissions

Record identity, object, method and expected result. Include successful owner controls as well as forbidden cross-owner requests. The fixture matrix below is intentionally small and deterministic; it does not enumerate unknown identifiers. Downloads and exports should obey the same boundary as the main resource.

Run an authorized assessment

Configure the project’s authorization profiles and scenarios, select the appropriate environment and start the approved profile. Scantelio must observe both a valid authorized control and the relevant forbidden request before drawing an access conclusion. Expired credentials, missing markers or a changed fixture can make a result inconclusive.

python3 access-fixture.py
curl -H "X-Fixture-User: a" "http://127.0.0.1:8769/documents/doc-b?mode=vulnerable"
curl -H "X-Fixture-User: a" "http://127.0.0.1:8769/documents/doc-b?mode=fixed"

Primary sources: Primary reference 1

Continue: JWT security: validate tokens and access lifecycle

What OpenAPI can and cannot tell you

A schema helps identify methods, paths and parameter structure. It does not establish which organization owns a document or whether a particular user may change its role. Importing operations is not permission to invoke every operation. Supply concrete approved paths and explicit expected access.

Separate production and staging

Approved read-only checks can run against a suitable production scope. Requests that change data, active injection checks and configured rate-limit diagnostics belong in staging with separate consent. Use synthetic records and a verifiable restoration step for mutations. Do not reuse a production administrator token as a convenience.

Primary sources: Primary reference 1

Continue: Add security checks to CI/CD and GitHub Actions

Read coverage and budgets

Check which operations were attempted and which were skipped, inapplicable or inconclusive. A completed run can still have limits. WAF responses, timeouts, missing preparation and exhausted request budgets are not a clean bill of health. Prioritize relevant scenarios instead of assuming every API operation was tested.

Fix and retest

Turn sanitized evidence into a development task with a precise permission rule. After the change, rerun the original forbidden request and the legitimate owner control. Keep the deployment revision and fixture version. Once stable, add the supported CI or scheduling workflow rather than treating one scan as permanent assurance.

Continue: Check your own website for vulnerabilities by URL

Reproducible examples and downloads

Tested with: guides-1 · Python 3.13.0 · PyJWT 2.15.1

All example data is synthetic. Downloads contain no active keys or customer records. Run examples only in your own isolated test environment.

• access-matrix.csv — example / template
• access-fixture.py — example / template

Example verification record: versions, actions and observations

Questions and answers

Editorial team and sources

Scantelio editorial team: methodology and limitations. Example verified: 2026-11-02.

• Reference 1 · cheatsheetseries.owasp.org
• Reference 2 · cheatsheetseries.owasp.org