<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

---
technique: Performing Database Security Testing
subdomain: security-testing
type: api-reference
---

# Performing Database Security Testing — API Reference

> API reference for conduct security assessments of database systems including access controls, encryption, injection vulnerabilities, and data exposure risks.

## Base URL

```
https://api.cipher.security/v1
```

## Authentication

All endpoints require Bearer token authentication:

```
Authorization: Bearer <token>
```

## Endpoints

### `POST /api/v1/database/targets`

Add a database target for testing

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `id` | string | varies | Resource identifier |

**Response:**

```json
{
  "status": "success",
  "data": {},
  "metadata": {
    "timestamp": "2026-01-01T00:00:00Z",
    "request_id": "req-abc123"
  }
}
```

---

### `POST /api/v1/database/scan`

Run database security assessment

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `id` | string | varies | Resource identifier |

**Response:**

```json
{
  "status": "success",
  "data": {},
  "metadata": {
    "timestamp": "2026-01-01T00:00:00Z",
    "request_id": "req-abc123"
  }
}
```

---

### `GET /api/v1/database/findings`

Get database security findings

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `id` | string | varies | Resource identifier |

**Response:**

```json
{
  "status": "success",
  "data": {},
  "metadata": {
    "timestamp": "2026-01-01T00:00:00Z",
    "request_id": "req-abc123"
  }
}
```

---

### `POST /api/v1/database/injection-test`

Run SQL/NoSQL injection tests

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `id` | string | varies | Resource identifier |

**Response:**

```json
{
  "status": "success",
  "data": {},
  "metadata": {
    "timestamp": "2026-01-01T00:00:00Z",
    "request_id": "req-abc123"
  }
}
```

---

### `POST /api/v1/database/report`

Generate database security test report

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `id` | string | varies | Resource identifier |

**Response:**

```json
{
  "status": "success",
  "data": {},
  "metadata": {
    "timestamp": "2026-01-01T00:00:00Z",
    "request_id": "req-abc123"
  }
}
```

---

## Error Handling

All errors follow a consistent format:

```json
{
  "status": "error",
  "error": {
    "code": "INVALID_REQUEST",
    "message": "Descriptive error message",
    "details": {}
  }
}
```

## Rate Limiting

API requests are rate-limited to 100 requests per minute per token. Rate limit headers are included in all responses:

- `X-RateLimit-Limit`: Maximum requests per window
- `X-RateLimit-Remaining`: Remaining requests in current window
- `X-RateLimit-Reset`: Unix timestamp when the window resets
