# API Scan Scope Checklist — ApiScanner.com

Use this discussion checklist for systems you own or have explicit permission to assess. It is not an authorization grant or an executable test.

## 1. Authority and boundaries
- Identify the application owner and person approving the assessment.
- Record the exact environment, hosts, methods, and route families.
- Name excluded third parties and production dependencies.
- Agree on the validity period and process for scope changes.

## 2. Application behavior
- Describe the business question and expected permission boundary.
- Prepare limited test roles and synthetic records with known ownership.
- Record both permitted and denied cases.
- Exclude destructive actions, real payments, bulk messaging, and other unapproved mutations.

## 3. Runner and credentials
- Select a documented scan mode and check its actual network behavior.
- Record the tool version, configuration, runtime, and application revision.
- Restrict network access to approved destinations.
- Resolve short-lived credentials through the approved secret mechanism; do not commit or print them.

## 4. Operational limits
- Agree on request budget, concurrency, duration, and retry limits.
- Identify an operator who can observe and stop the run.
- Record monitoring signals, interruption handling, and recovery procedures.
- Prevent overlapping scheduled assessments against the same environment.

## 5. Preflight
- Confirm the target environment, contract, and synthetic data.
- Validate the limited identity using an approved operation.
- Verify restricted report storage and available capacity.
- Treat failed preflight as incomplete coverage, not a passing assessment.

## 6. Evidence and follow-through
- Separate run status, observations, confidence, and review decisions.
- Preserve the expected and observed behavior with a sanitized evidence reference.
- Assign a reviewer and next action; do not infer severity from a label alone.
- Protect detailed artifacts and define their retention.
- Retest the repaired failing case and legitimate permitted behavior.

Source context and further reading: https://apiscanner.com/resources/