Sample Assessment Report
Redacted for confidentiality
API Security
REST, GraphQL & SOAP API Testing
Confidential Client — SaaS Platform
REST API v2 (312 endpoints), GraphQL API (public schema), internal microservices API gateway
6 business days
OWASP API Security Top 10 2023
Executive Summary
UnlockSec assessed the client's API surface across REST, GraphQL, and internal microservice APIs. A total of 26 findings were identified including a Broken Object Level Authorization vulnerability affecting 312,000 customer records, a GraphQL introspection-enabled schema disclosure, and a mass assignment vulnerability allowing privilege escalation to administrator accounts.
Methodology
Sample Findings
BOLA — Broken Object Level Authorization on Customer Data API
Description
The GET /api/v2/customers/{customerId}/data endpoint does not validate the relationship between the authenticated user's organisation and the requested customer ID. An authenticated user from Organisation A can request data for customers belonging to Organisation B by supplying their customer IDs.
Recommendation
Implement server-side ownership validation on every object-level API request. Use scoped, non-predictable resource identifiers. Add centralised authorisation middleware rather than inline checks.
Mass Assignment — User Role Escalation via API
Description
The PUT /api/v2/users/profile endpoint accepts and processes the 'role' parameter which should be server-controlled. Supplying role: 'admin' in the request body successfully escalates the authenticated user to administrator privileges.
Recommendation
Implement an allowlist of accepted request body parameters. Exclude all security-sensitive fields (role, permissions, plan) from client-editable API parameters. Apply schema validation on all API inputs.
GraphQL Introspection Enabled in Production
Description
GraphQL introspection is enabled on the production endpoint, exposing the complete API schema including internal mutations, type definitions, and deprecated fields. This significantly reduces the reconnaissance barrier for targeted attacks.
Recommendation
Disable GraphQL introspection in production environments. Implement query depth limiting, complexity analysis, and field-level authorisation. Consider persisted queries for public-facing GraphQL APIs.
Excessive Data Exposure — API Returns Full Objects
Description
The /api/v2/users/search endpoint returns complete user objects including hashed passwords, internal user IDs, account creation timestamps, and administrative notes — far exceeding the data required by the calling client.
Recommendation
Apply response filtering at the API layer to return only fields required by the requesting client. Implement API response schemas and validate all outgoing payloads against them.
* Showing 4 of 30 total findings. Full report provided upon engagement.
Risk Summary
Deliverables Included
- OWASP API Top 10 coverage report
- Endpoint-by-endpoint risk assessment
- GraphQL schema security review
- Annotated Burp Suite and Postman collections as evidence
- Remediation-tracked retest report
Ready for a real assessment?
Get a tailored API Security engagement led by certified operators with unlimited retests.
Request AssessmentView All Services