Use case
APIs fail at the edges between roles.
Most API issues are not injection; they are one role reaching another role's data. That needs two identities and a tester willing to compare them, which is what the agent does.
- Surface
- Endpoints and parameters discovered rather than taken from a specification you may not have.
- Identities
- Two where possible, because horizontal access control cannot be tested with one.
- Classes
- Injection, access control, authentication, data exposure and misconfiguration.
- Output
- Findings with the exact request and response that demonstrate them.
Start with this one use case.
One target is enough to judge the output.