In order to test the security of my API, I want to act as sort of an attacker in order to try and gain access to my own API without an API key.
In order for me to send requests to this endpoint, I need to include a 32 long character string (API key/cert) in the header of the request. This means I basically can't brute force an API key, it would take ages.
What other options are out there for me to exploit and gain access to this endpoint? Is my API secure against a possible attack?
The information I know as an "attacker" is that the server the API runs on is Microsoft-IIS/8.5, running ASP.NET version 4.0.30319, and that this is a REST API.