<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-api-threat-modeling
description: >-
  Threat model APIs by analyzing OpenAPI specs, auth flows, and data exposure.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - api-security
  - openapi
  - graphql
  - grpc
  - oauth
  - input-validation
  - rate-limiting
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - "T1190"
  - "T1059.007"
  - "T1071.001"
---

# Performing API Threat Modeling

## Overview

APIs are the primary attack surface for modern applications. This technique applies structured
threat modeling to REST, GraphQL, and gRPC interfaces by analyzing OpenAPI/Swagger specifications,
authentication mechanisms, authorization boundaries, input validation, rate limiting, and data
exposure risks.

Mode: `[MODE: ARCHITECT]` — Systematic API security analysis and hardening.

## Prerequisites

- OpenAPI 3.x specification or GraphQL schema
- `openapi-spec-validator`: `pip install openapi-spec-validator`
- Python 3.10+
- API documentation or running instance for validation

## Key Concepts

### OWASP API Security Top 10 (2023)

| ID | Risk | Threat Category |
|----|------|----------------|
| API1 | Broken Object Level Authorization | BOLA/IDOR |
| API2 | Broken Authentication | Credential attacks |
| API3 | Broken Object Property Level Authorization | Mass assignment |
| API4 | Unrestricted Resource Consumption | DoS, bill abuse |
| API5 | Broken Function Level Authorization | Privilege escalation |
| API6 | Unrestricted Access to Sensitive Business Flows | Automation abuse |
| API7 | Server Side Request Forgery | SSRF |
| API8 | Security Misconfiguration | Headers, CORS, verbose errors |
| API9 | Improper Inventory Management | Shadow APIs |
| API10 | Unsafe Consumption of APIs | Third-party trust |

### API Threat Vectors

- **Authentication bypass** — weak tokens, missing validation, session fixation
- **Authorization flaws** — IDOR, horizontal/vertical privilege escalation
- **Injection** — SQLi, NoSQLi, GraphQL injection, command injection
- **Data exposure** — over-fetching, verbose errors, missing field filtering
- **Rate limiting gaps** — brute force, credential stuffing, resource exhaustion

## Workflow

### Step 1: Parse API Specification

```bash
node scripts/agent.js --action analyze --input openapi.yaml
node scripts/agent.js --action enumerate --input openapi.yaml
```

### Step 2: Identify Threats

```bash
node scripts/agent.js --action threats --input endpoints.json
```

### Step 3: Generate Report

```bash
node scripts/agent.js --action report --input threats.json --output report.json
```

## Verification

- [ ] All API endpoints catalogued with methods, auth, and input schemas
- [ ] Authentication mechanisms reviewed (OAuth 2.0 flows, JWT validation, API keys)
- [ ] Authorization checked for BOLA/IDOR on every object-accessing endpoint
- [ ] Rate limiting configured and tested on authentication and sensitive endpoints
- [ ] Response schemas reviewed for data over-exposure
- [ ] CORS, security headers, and error handling validated

## References

- [OWASP API Security Top 10 (2023)](https://owasp.org/API-Security/)
- [OpenAPI Security Scheme](https://swagger.io/docs/specification/authentication/)
- [NIST SP 800-95 — Guide to Secure Web Services](https://csrc.nist.gov/publications/detail/sp/800-95/final)
- [GraphQL Security Best Practices](https://graphql.org/learn/authorization/)
