# API Business Flow Abuse

Testing and exploiting automatable business operations including coupons, referrals...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill api-business-flow-abuse -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill api-business-flow-abuse -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill api-business-flow-abuse -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill api-business-flow-abuse -g -a gemini-cli -y`

## Description

Testing and exploiting automatable business operations including coupons, referrals, OTPs, reservations, purchases, trials, and pricing at unauthorized scale

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# API Business Flow Abuse (OWASP API6)

## Purpose
Identify and exploit API operations that create business value/cost and test whether they can be automated, repeated, or abused beyond their intended human workflow limits.

## Preconditions
- A functional API surface with identified state-changing endpoints
- Understanding of what the business does and what operations cost money or resources

## Attack Surface Signals
- Coupon/discount/promo code endpoints
- Referral/affiliate/invite endpoints
- OTP/password-reset/SMS/email sending endpoints
- Account creation, free trial, or signup endpoints
- Purchase/booking/reservation endpoints
- Gift card/voucher redemption
- Export/report generation
- Username/email availability checks
- Voting/rating/review endpoints
- Pricing/quote calculators
- Inventory reservation or hold endpoints

## Methodology

### Step 1: Identify Business-Valuable Operations
Map endpoints that:
- Create or consume monetary value
- Send communications (email/SMS/push)
- Reserve limited resources
- Grant access or privileges
- Generate computational work on the backend

### Step 2: Understand the Intended Human Workflow
For each identified operation:
- What is the intended user flow? (e.g., coupon redeemed once at checkout)
- What limits/invariants should hold? (e.g., one coupon per account, one trial per user)
- What is the cost to the business if abused at scale?

### Step 3: Test Repeatability
```bash
# Coupon: try redeeming the same coupon multiple times
for i in $(seq 1 5); do
  curl -sk -X POST "https://TARGET/api/coupons/redeem" \
    -H "Authorization: Bearer USER_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"code":"WELCOME10"}' | jq -r '.success // .status'
done

# Referral: try claiming the same referral bonus repeatedly
curl -sk -X POST "https://TARGET/api/referrals/claim" \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"referralCode":"ABC123"}'
```

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/api-security/api-business-flow-abuse/SKILL.md