Black box, grey box or white box. Interopt tests with whatever you give it.
Start your first free runAuthorisation is where APIs fail, and it fails one endpoint at a time. It tests each one with accounts it controls, then shows you the request and the response that settled it.
Most of an API's risk sits in who is allowed to call what, and it is rarely the only thing wrong.
The one that empties an API. Change an identifier and see whose record comes back. It runs this from two accounts it holds itself and reads the object back afterwards, because a 200 is not proof that anything was allowed, and a 403 on one route is not proof of the next.
Administrative routes that check what the interface renders rather than what the token carries, and operations the platform exposes that no screen in your product ever calls. What the client never shows is still there to be invoked.
Whether role, tier, balance or a verified flag can be posted into an update, and whether the value actually stuck, which is settled by reading the object back rather than by the status code that came back.
Tokens that outlive a logout, refresh flows that hand back more than they were asked for, endpoints that accept a token minted for something else entirely, and login routes with nothing throttling them.
SQL and command injection behind JSON bodies and query parameters, and what a malformed request gives back on the way out. A stack trace returned to a caller is its own finding.
An endpoint that returns the whole record because the client only renders three fields of it, and operations that cost you money or compute every time somebody calls them. What your interface hides is not hidden from anyone reading the response.
An endpoint written down nowhere and called by nothing is still reachable, and still yours.
An API named as a target is tested as one, operation by operation, rather than as whatever a crawler happened to walk into.
It drives your own front end and watches what the client actually calls. Endpoints that never made it into a specification surface here, because something in your product is already using them.
With the repository connected it reads the route definitions themselves. An endpoint that is documented nowhere and called by nothing is still on the list, and still gets tested.
The request it sent and the response it got back, against the endpoint it sent them to. Run it again yourself and get the same result.
The report we used to write by hand after an engagement, generated from the run. It is what teams hand over as pentest evidence for ISO 27001 or SOC 2, and it is ready when the run is.
With your repository connected, the missing check is written where it belongs and opened against your branch for review.
Weekly, monthly, or on every push. A new endpoint that ships on Tuesday is tested on Tuesday, not at the next assessment.
A base URL and an account is enough to start. Connect the repository and the missing check comes back written.
