# API Security Testing

Tests REST, GraphQL, and gRPC APIs for broken authorization and other OWASP API flaws.

- Repository: https://github.com/usestrix/strix (73218 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add usestrix/strix --skill api-security-testing -g -a claude-code -y`
Codex: `npx skills add usestrix/strix --skill api-security-testing -g -a codex -y`
Cursor: `npx skills add usestrix/strix --skill api-security-testing -g -a cursor -y`
Gemini CLI: `npx skills add usestrix/strix --skill api-security-testing -g -a gemini-cli -y`

## Description

Security-test a REST, GraphQL, or gRPC API with Strix, autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-specific vulnerability classes in the OWASP API Security Top 10 (2023), broken object-level authorization (BOLA/IDOR), broken object property level authorization (excessive data exposure and mass assignment), broken function-level authorization, unrestricted resource consumption, SSRF, injection, and auth/token flaws. Every finding comes with a working proof-of-concept request. Use when the user asks to pentest, security-test, audit, or find vulnerabilities in an API, endpoint, or backend service.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Security-test an API

APIs fail differently from web UIs: there is no rendered surface to crawl, the interesting bugs are authorization-shaped rather than injection-shaped, and the same endpoint behaves differently per token. This workflow targets those specifics with Strix's autonomous agents, using the current [OWASP API Security Top 10 (2023)](https://owasp.org/API-Security/editions/2023/en/0x11-t10/) as the coverage checklist. For the web-app equivalent, the current edition is the OWASP Top 10:2025, see **owasp-top-10-testing**.

Install, LLM setup, full CLI flags, and the managed-cloud path are in the **penetration-testing-with-strix** skill. Read it if `strix --version` fails or the target is not an API. For a run with no Docker and no LLM key, the same binary drives the managed platform: `strix cloud login`, then `strix cloud scans start ...` (details in **managed-pentesting-with-strix**).

## 1. Gather what the agents need

APIs are near-impossible to test blind, so collect first:

The rest: https://github.com/usestrix/strix/blob/HEAD/skills/api-security-testing/SKILL.md