Useful things. Ready to take with you.

Scope checklist

Define the authorized target before selecting a tool. Our checklist covers environment ownership, allowed operations, third-party exclusions, test identities, synthetic data, request budgets, stop conditions, evidence handling, and retesting. Use it as a discussion guide with the application owner, not as an automated authorization system.

Download the API scan scope checklist (.md). The file is ordinary Markdown that you can read locally and adapt to your approved process. It contains no executable scanning commands and is not uploaded back to this website.

Illustrative assessment report

See how run status, scope, observations, evidence, and review decisions can be separated. The sample describes a fictional staging inventory API. Its eight routes and three observations are invented teaching data, not live measurements or a security verdict.

Read the sample report or download the JSON (.json). The report integration guide explains the fields and how to preserve missing information.

AI security prompt pack

Use six narrowly scoped prompts for evidence summaries, assessment planning, ticket drafts, inventory review, agent authority, and retest plans. Each prompt preserves missing facts and keeps network execution outside the task.

Open the copyable prompt library or download all six prompts (.md). Redact credentials and personal information before using any external model, and check the approved data-handling arrangement for your chosen service.

Scanner evaluation worksheet

Compare operating effort, supported authentication, scope controls, run completeness, export quality, and review cost. Record the evidence for a feature rather than merely ticking a box. A capability that has not been demonstrated should remain unknown.

Download the evaluation worksheet (.md) and read the free vs. premium guide. The worksheet contains no current vendor prices, fabricated rankings, or invented traffic metrics.

Follow the field notes

The API Security Field Notes blog contains ten long-form guides across fundamentals, operations, AI security, and application security. Browse the category pages for a reading path, or use topic tags to connect related ideas.

Subscribe to the RSS feed in your feed reader. It includes full article content and links to substantive site pages. No email signup or account is required.

Use the source, then check your version

The primary references below support the technical foundations used across these resources. Product behavior can vary by release and configuration. Read the documentation for the tool and framework version you actually operate before running an assessment.

Primary references

Read the documentation that matches your tool, framework, and deployment. These sources provide context; they do not establish coverage of your environment.

• OWASP API Security Top 10 — 2023
• OWASP REST Security Cheat Sheet
• ZAP getting started
• ZAP baseline scan documentation
• ZAP API scan documentation
• OWASP LLM06:2025 — Excessive Agency
• WordPress custom REST endpoints
• Django 5.2 security documentation
• OWASP Internet of Things
• OpenAI safety best practices