Security

Trace how a request reaches protected data or an action with consequences. Identify the acting identity, the resource, the input that selects it, and the control that permits or denies access. Repeat this reasoning for returned fields and for data received from another service.

The security testing guide turns those assumptions into repeatable checks. Use known roles and controlled records so expected access is unambiguous. Examine the response and the resulting state; an unsuccessful operation can still reveal information or leave an unintended change.

For a practical set of scenarios, read the API permission checklist. Keep evidence minimal and appropriately redacted. Tie each finding to the observed conditions, an accountable owner, and a clear retest requirement so a correction can be assessed against the original failure.