Security Testing APIs in CI

Layer automated tests: SAST and secret scanning on every commit, SCA (dependency vulnerabilities), spec linting for security rules (auth defined on every operation), authorization matrix tests (roles × endpoints, cross-tenant BOLA checks), DAST against a deployed test environment (OWASP ZAP API scan with your OpenAPI spec), and schema-based fuzzing (Schemathesis/RESTler). Add periodic manual pentests for business-logic flaws automated tools miss.

Testing layers

jobs:
  api-security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npx @stoplight/spectral-cli lint openapi.yaml --ruleset .spectral-owasp.yaml
      - run: pip install schemathesis && schemathesis run openapi.yaml --url "$STAGING_URL" --checks all
      - run: pytest tests/security -q            # BOLA/BFLA matrix

@pytest.mark.parametrize("path", object_routes_from_openapi())
async def test_cross_tenant_access_denied(path, tenant_a, tenant_b):
    obj_id = await create_object_for(path, tenant_a)
    resp = await tenant_b.client.get(path.format(id=obj_id))
    assert resp.status_code in (403, 404), f"BOLA on {path}"

Common pitfalls

• DAST without authentication (only tests the login page).
• No tests for authorization at all.
• Scans whose findings nobody triages.

Key points

• Automate authorization tests
• Spec-driven DAST and fuzzing
• Triage and SLAs for findings

Further reading: Schemathesis