> ## Documentation Index
> Fetch the complete documentation index at: https://docs.snapsec.co/llms.txt
> Use this file to discover all available pages before exploring further.

# API Pentesting

> Specialized security testing for REST, GraphQL, gRPC, and microservice APIs.

APIs account for the majority of modern data breaches. Snapsec conducts automated API penetration testing based on the OWASP API Security Top 10.

***

## Coverage Areas

* **BOLA / IDOR (API1:2023)**: Object-level authorization bypasses across endpoint parameters.
* **Broken Authentication (API2:2023)**: Weak JWT validation, token replay, missing rate limits on password resets.
* **Unrestricted Resource Consumption (API4:2023)**: Denial of service via complex GraphQL nested queries or payload bombs.
* **Server-Side Request Forgery (API7:2023)**: Exploiting webhook endpoints to query internal cloud metadata.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.