Automated application programming interface (API) testing

One or more non-transitory computer-readable storage media having program instructions stored thereon to detect security vulnerabilities in an Application Programming Interface (API), wherein the program instructions, when executed by a computing system, direct the computing system to perform operations, the operations comprising:

• collecting API traffic to determine API request types, data exposed by the API, and endpoints accessible by the API and responsively generating contextual information that indicates the API request types, the data exposed by the API, and the endpoints accessible by the API to characterize expected operations of the API;
• generating an API test that comprises a modified API call to drive the API to perform an unauthorized operation based on the contextual information to detect the security vulnerabilities in the API, wherein the modified API call comprises a different API request type than the API request types indicated by the contextual information;
• executing the API test on the API by transferring the modified API call to the API;
• generating test results based on the API response that indicate detected security vulnerabilities in the API;
• and
• exporting the test results.

An apparatus to detect security vulnerabilities in an Application Programming Interface (API), the apparatus comprising:

• one or more computer-readable storage media;
• a processing system operatively coupled with the one or more computer-readable storage media;
• and
• program instructions stored on the one or more computer-readable storage media that, when executed by the processing system, direct the processing system to at least:
• collect API traffic to determine API request types, data exposed by the API, and endpoints accessible by the API and responsively generate contextual information that indicates the API request types, the data exposed by the API, and the endpoints accessible by the API to characterize expected operations of the API;
• generate an API test that comprises a modified API calls to drive the API to perform an unauthorized operation based on the contextual information to detect the security vulnerabilities in the API, wherein the modified API calls comprise a different API request type than the API request types indicated by the contextual information;
• execute the API test on the API by transferring the modified API calls to the API;
• receive API responses to the modified API calls;
• generate test results based on the API responses that indicate detected security vulnerabilities in the API;
• and
• export the test results.