Skip to content

Scope a web and API security test

Give the assistant a verified target, the allowed operations and the expected access model. Review its draft before running Scantelio. The report separates reproduced behavior from suspected issues and uncovered endpoints.

Prepare an API test plan →

From service description to test scope

  • Target: pin the staging origin and select a read-only invoice operation.
  • Identity: supply test bearer credentials through protected settings. Keep tokens out of prompts.
  • Evidence: compare the owner control with the cross-account response and record only redacted evidence.

Prepare the check with your AI assistant

Sample conversation

Our API has a public health endpoint and a private invoices endpoint. Turn that description into a staging test plan.

Assistant · I’ll keep the health check outside the authorization assertion. Which staging invoice belongs to account A, and what should B receive when requesting that invoice?

On first setup, verify the target and grant the assistant access to the intended project. Review the draft and confirm the run in your workspace.

Illustrative result and next action

A 200 with an empty list is inconclusive. A 200 containing the other test tenant’s private invoice is evidence. An expired token leaves that route untested.

Questions before you start

Can I use the same plan in CI?

After verifying the target and eligible plan, run the supported CLI in CI. Use staging and keep the credential in the runner’s secrets.

How do I limit the scope?

Choose the verified environment, component and permitted operations. Restrict active scenarios to staging and review the proposed profile.

What constitutes evidence?

Record the actor, the fixture owner, expected policy and actual response. Compare with a successful owner control and redact credentials.

Does the scanner inspect every source file?

A reachable web/API check observes runtime behavior. Review source code separately when the question concerns unexposed paths or implementation details.

What can a public URL show?

An external check examines the reachable surface. Private workflows require authorized access and suitable test accounts. A source-code review or expert investigation has a different scope.

Can I reuse a prepared project?

Select the verified project, review the environment and permissions, then confirm the run. Recheck fixtures if the release changed the access model.