<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

---
technique: Building Security Testing Methodology
subdomain: security-testing
type: api-reference
---

# Building Security Testing Methodology — API Reference

> API reference for design and implement standardized security testing methodologies that ensure consistent, repeatable, and comprehensive security assessments.

## Base URL

```
https://api.cipher.security/v1
```

## Authentication

All endpoints require Bearer token authentication:

```
Authorization: Bearer <token>
```

## Endpoints

### `POST /api/v1/methodology`

Create a new testing methodology

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `id` | string | varies | Resource identifier |

**Response:**

```json
{
  "status": "success",
  "data": {},
  "metadata": {
    "timestamp": "2026-01-01T00:00:00Z",
    "request_id": "req-abc123"
  }
}
```

---

### `POST /api/v1/methodology/{id}/cases`

Add test cases to methodology

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `id` | string | varies | Resource identifier |

**Response:**

```json
{
  "status": "success",
  "data": {},
  "metadata": {
    "timestamp": "2026-01-01T00:00:00Z",
    "request_id": "req-abc123"
  }
}
```

---

### `GET /api/v1/methodology/{id}/coverage`

Get test coverage report

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `id` | string | varies | Resource identifier |

**Response:**

```json
{
  "status": "success",
  "data": {},
  "metadata": {
    "timestamp": "2026-01-01T00:00:00Z",
    "request_id": "req-abc123"
  }
}
```

---

### `PUT /api/v1/methodology/{id}/cases/{case_id}`

Update test case status

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `id` | string | varies | Resource identifier |

**Response:**

```json
{
  "status": "success",
  "data": {},
  "metadata": {
    "timestamp": "2026-01-01T00:00:00Z",
    "request_id": "req-abc123"
  }
}
```

---

### `POST /api/v1/methodology/{id}/report`

Generate methodology coverage report

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `id` | string | varies | Resource identifier |

**Response:**

```json
{
  "status": "success",
  "data": {},
  "metadata": {
    "timestamp": "2026-01-01T00:00:00Z",
    "request_id": "req-abc123"
  }
}
```

---

## Error Handling

All errors follow a consistent format:

```json
{
  "status": "error",
  "error": {
    "code": "INVALID_REQUEST",
    "message": "Descriptive error message",
    "details": {}
  }
}
```

## Rate Limiting

API requests are rate-limited to 100 requests per minute per token. Rate limit headers are included in all responses:

- `X-RateLimit-Limit`: Maximum requests per window
- `X-RateLimit-Remaining`: Remaining requests in current window
- `X-RateLimit-Reset`: Unix timestamp when the window resets
