I am learning API pen testing and looking for resources which will give clear list of test cases we need to check while performing a Pen testing on REST API.

I have gone through the OWASP resources API Security Cheat_sheet.

Still I have some confusion. Can anyone give me the list or links where I can find the REST API security checklist?

1 Answer 1


There is no standard list of test cases here. OWASP’s cheat sheet is a good start. Otherwise, define your threat model and just test against it, as tailored to your application. These are the struggles of security testing (or any kind of testing really I’m afraid). Good testing design requires analysis of the target application, so us out here on the Internet can’t really give a useful answer without knowing your application. Good luck!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .