<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Security Templates — API Reference

## Nuclei API Scanning Options

```bash
# Scan API endpoint
nuclei -u https://api.target.com -t api-security.yaml -json

# With auth header
nuclei -u https://api.target.com -t api-template.yaml \
  -H "Authorization: Bearer token" -json

# GraphQL endpoint scan
nuclei -u https://target.com/graphql -t graphql-templates/ -json
```

## OWASP API Security Top 10 Coverage

| ID | Vulnerability | Template Pattern |
|----|--------------|------------------|
| API1 | Broken Object Level Auth | Sequential ID access test |
| API2 | Broken Authentication | Default creds, JWT flaws |
| API3 | Excessive Data Exposure | Sensitive field detection |
| API4 | Lack of Resources/Rate Limit | Rapid request testing |
| API5 | Broken Function Level Auth | Admin endpoint access |
| API6 | Mass Assignment | Privilege field injection |
| API7 | Security Misconfiguration | CORS, headers, debug |
| API8 | Injection | SQLi, NoSQLi, command |
| API9 | Improper Assets Management | Version enumeration |
| API10 | Insufficient Logging | Error response analysis |

## API-Specific Matchers

| Pattern | Purpose |
|---------|---------|
| `application/json` header | Confirm JSON API response |
| Sensitive field regex | Detect data exposure |
| Status 200 + no error words | Confirm successful access |
| `negative: true` on errors | Exclude error responses |

## GraphQL-Specific Fields

| Field | Value | Purpose |
|-------|-------|---------|
| `method` | POST | GraphQL uses POST |
| `Content-Type` | application/json | JSON query body |
| `body` | `{"query":"..."}` | GraphQL query payload |

## Common API Paths

| Pattern | Purpose |
|---------|---------|
| `/api/v1/users` | User endpoint |
| `/graphql` | GraphQL endpoint |
| `/api/swagger.json` | API documentation |
| `/api/health` | Health check endpoint |
| `/.well-known/openapi.json` | OpenAPI spec |
