API Security Testing
Tests REST, GraphQL, and gRPC APIs for broken authorization and other OWASP API flaws.
Install
npx skills add usestrix/strix --skill api-security-testing -g -a claude-code -y- Repository
- usestrix/strix73.2k
- Category
- Security
- Updated
- 4d ago
- License
- Apache-2.0
- Context cost
- Lightabout 1,373 tokens
- Runs scripts
- No, instructions only
What it does
Security-test a REST, GraphQL, or gRPC API with Strix, autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-specific vulnerability classes in the OWASP API Security Top 10 (2023), broken object-level authorization (BOLA/IDOR), broken object property level authorization (excessive data exposure and mass assignment), broken function-level authorization, unrestricted resource consumption, SSRF, injection, and auth/token flaws. Every finding comes with a working proof-of-concept request. Use when the user asks to pentest, security-test, audit, or find vulnerabilities in an API, endpoint, or backend service.
Security-test an API
APIs fail differently from web UIs: there is no rendered surface to crawl, the interesting bugs are authorization-shaped rather than injection-shaped, and the same endpoint behaves differently per token. This workflow targets those specifics with Strix's autonomous agents, using the current OWASP API Security Top 10 (2023) as the coverage checklist. For the web-app equivalent, the current edition is the OWASP Top 10:2025, see owasp-top-10-testing.
Install, LLM setup, full CLI flags, and the managed-cloud path are in the penetration-testing-with-strix skill. Read it if strix --version fails or the target is not an API. For a run with no Docker and no LLM key, the same binary drives the managed platform: strix cloud login, then strix cloud scans start ... (details in managed-pentesting-with-strix).
1. Gather what the agents need
APIs are near-impossible to test blind, so collect first:
