API security assessment
Examine API security, webhooks, integrations, authentication, error handling and reliability against the interfaces as built.
What BSA is designed to examine
- REST endpoint discovery and comparison with the published OpenAPI description.
- Authentication, authorization and tenant isolation on each endpoint.
- Request and response validation, error handling, pagination and data leakage.
- Webhook handling: signature validation, replay protection, idempotency and retry behavior.
- Database behavior behind the API: unsafe queries, permissions, missing isolation and restore testing.
How results are meant to be reported
- Results are tied to the specific request and response that showed the behavior.
- Destructive requests are not sent against production by default.
- Targets without a recorded authorization receive passive checks only.
An API that was not reachable or not in scope is reported as not tested.
Status
BSA is in development. This site describes what the platform is designed to do. It does not report completed audits, customers, certifications or integrations.