A practical, ordered methodology for penetration testing an API, from enumerating every operation to reporting with CVSS and remediation. Each step names the manual approach and how an agentic tool automates it, so you can follow it by hand or understand what Planck Operator does on every run.
A pentest begins with written authorization and a rules-of-engagement agreement, never before. Agree on the environments in scope, the roles and tenants you will test as, the rate ceilings, and which destructive actions require explicit sign-off. Testing is read-only by default against production, so a live system is assessed without being degraded. The eight steps below then run in order, each building on the last. This mirrors our API penetration testing engagement and the full methodology.
Manual: collect the OpenAPI, GraphQL SDL, or protobuf definitions and list every endpoint, method, and parameter, then hunt undocumented, retired, and debug routes by hand.
Automated: the agent ingests the spec, enumerates every operation, and rebuilds the reachable surface each run, including shadow and zombie endpoints.
Manual: learn the auth model, provision credentials for each role and tenant, and probe token issuance, validation, expiry, and revocation for weaknesses.
Automated: the agent takes one token per role and exercises the token lifecycle as an attack surface while it works.
Manual: build an authorization matrix and test BOLA by replaying one account's requests as another, and BFLA by calling privileged functions from lower roles.
Automated: the agent replays identities across every object-scoped operation and privileged function, proving cross-account and cross-role access.
Manual: deliver SQL, NoSQL, command, and template injection through bodies, query parameters, GraphQL arguments, and metadata, and test mass assignment per property.
Automated: the agent tailors payloads to each content type and probes every parameter, including writable properties the client never advertises.
Manual: walk multi-step flows such as purchase, transfer, and recovery for logic that authorization checks miss, including race conditions and replay.
Automated: the agent models the sensitive flows in scope and checks whether they can be driven or abused at automated scale.
Manual: measure what one caller can make the API spend through unbounded pagination and expensive queries, and probe rate limits on login and OTP endpoints.
Automated: the agent measures cost per request and ramps volume in a throttled, coordinated way that records the threshold without causing an outage.
Manual: confirm each candidate with captured request and response evidence and a repeatable sequence, chaining steps into a working exploit where relevant.
Automated: the agent proves each finding with evidence and a reproducible sequence, discarding anything it cannot demonstrate.
Manual: write each finding with reproduction steps, a CVSS rating adjusted for real exploitability, and remediation at the code, gateway, or schema level, plus an executive summary.
Automated: the agent produces the report per finding and reruns to verify fixes once they ship. See how findings are proven.
The methodology above can run against a live system without degrading it, provided the safeguards are built in. Read-only operations are the default, request volume is throttled to agreed ceilings, and any write, delete, or expensive operation is gated behind explicit approval rather than treated as a free action.
That discipline is what lets testing be continuous rather than a once-a-year event scheduled around a maintenance window. For where continuous testing fits against annual testing, see Meet Operator and the engagement methodology.
At a minimum, a definition of the API and credentials to reach it. A specification, whether an OpenAPI document, GraphQL SDL, or protobuf definitions, lets you enumerate every operation instead of guessing, and one token per role and tenant lets you test authorization properly. Written authorization and a rules-of-engagement agreement come first, since testing without permission is not a pentest.
Yes, with care. Read-only operations by default, throttled request volume agreed at scoping, and destructive actions gated behind explicit approval let you test a live system without degrading it. Planck Operator defaults to read-only against production and treats writes and expensive operations as controlled steps rather than free actions.
Authorization testing across roles and accounts. BOLA and BFLA cause most real API breaches and are exactly what scanners cannot find, because detecting them requires comparing what different identities are permitted to reach. If a methodology skips the authorization matrix, it is missing the highest-severity findings on most APIs.
A scanner runs fixed signatures against endpoints and produces alerts. An agentic tool reasons about the API from its specification, tests every operation across roles, chains steps into a working exploit, and proves each finding with evidence. It automates the manual methodology on this page rather than replacing it with pattern matching.
Give us a spec and one token per role, and the agent runs every step, from enumeration to proven findings and a CVSS report. Start with BOLA testing and BFLA testing.