Scan an API by feeding the scanner your API description, giving it test accounts for each role, and having it probe each endpoint for the risks in the OWASP API Security Top 10. Authorization flaws, the top items on that list, need tests with more than one user, so a single anonymous scan will miss them.
What the OWASP list gives you
The 2023 OWASP API Security Top 10 names ten risks: broken object level authorization, broken authentication, broken object property level authorization, unrestricted resource consumption, broken function level authorization, unrestricted access to sensitive business flows, server side request forgery, security misconfiguration, improper inventory management and unsafe consumption of APIs.
What a scanner can and cannot do well
| Risk area | Scanner fit | Why |
|---|---|---|
| Security misconfiguration | Good | Headers, verbose errors, open methods are observable |
| Broken authentication | Fair | Can test weak tokens and missing checks |
| Object level authorization | Needs two users | Must request user A's object as user B |
| Function level authorization | Needs role accounts | Must call admin routes as a normal user |
| Resource consumption | Partial | Rate limits can be probed, business impact cannot |
| Improper inventory | Needs your input | Scanner cannot find endpoints nobody documented, unless it sees traffic |
| Business flow abuse | Poor | Needs knowledge of what the flow means |
Steps
- Collect your API description, such as an OpenAPI file, and make sure it matches what is deployed. Undocumented endpoints are a risk in themselves.
- Create test accounts for each role plus a second account at the same role.
- Run the scan against a test or staging environment first, with data you can afford to modify.
- Configure authentication so the scanner can log in and refresh tokens.
- Review findings by risk. Fix authorization problems first since they expose other users' data.
- Add a regression test for each fixed issue, so it does not come back.
- Repeat on a schedule and on every change that adds or modifies an endpoint.
What scanning does not replace
Code review of authorization logic, threat modeling for business flows, and a retired endpoint audit. A scan shows symptoms. Design fixes close them.
Try it yourself
Open the demo and run the sample API scan. Look at which findings are authorization issues and which are configuration.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard's scanning covers dependencies and containers, and its asset discovery helps find what you run. For a first look at your dependencies, use the free scan.
Quick check
Can I scan production?
You can, but scans send unusual requests and may change data. Test environments with realistic data are safer for the first runs.
Why do I need two test users?
Object level authorization bugs show up only when one user requests another user's object. One account cannot test that.
Sources
- OWASP API Security Top 10, 2023 edition, api-security.owasp.org.
Last reviewed: 19 October 2026.
