<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing API Vulnerability Assessment

## nuclei API Templates

| Tag | Description |
|---|---|
| `api` | General API vulnerability checks |
| `owasp-api` | OWASP API Top 10 specific templates |
| `graphql` | GraphQL introspection and injection |
| `jwt` | JWT algorithm confusion and bypass |

## ZAP API Scan

| Command | Description |
|---|---|
| `zap-api-scan.py -t <spec> -f openapi` | Scan from OpenAPI spec |
| `zap-api-scan.py -t <spec> -f soap` | Scan from WSDL |
| `-J <file>` | JSON report output |
| `-r <file>` | HTML report output |

## ffuf API Fuzzing

| Command | Description |
|---|---|
| `ffuf -u <url>/FUZZ -w <wordlist>` | Path fuzzing |
| `ffuf -u <url> -X POST -d '{"key":"FUZZ"}'` | Parameter fuzzing |
| `-mc 200,201,401,403` | Match specific status codes |
| `-of json -o <file>` | JSON output |

## OWASP API Top 10 Categories

| ID | Name |
|---|---|
| API1 | Broken Object Level Authorization |
| API2 | Broken Authentication |
| API3 | Broken Object Property Level Authorization |
| API4 | Unrestricted Resource Consumption |
| API5 | Broken Function Level Authorization |
| API6 | Unrestricted Access to Sensitive Business Flows |
| API7 | Server Side Request Forgery |
| API8 | Security Misconfiguration |
| API9 | Improper Inventory Management |
| API10 | Unsafe Consumption of APIs |

## Agent Script

```bash
# Discover endpoints from OpenAPI spec
node agent.js discover https://target.example.com/openapi.json

# nuclei API scan
node agent.js nuclei https://target.example.com/api/v1/

# ZAP API scan
node agent.js zap https://target.example.com/openapi.json

# BOLA test
node agent.js bola https://target.example.com/api/v1/users --token $TOKEN --range 1-50

# Rate limit test
node agent.js rate-limit https://target.example.com/api/v1/login --count 200
```
