“Internal” describes an endpoint’s current audience. It is not a security boundary.
Internal APIs often become dependencies for mobile apps, other teams, partners, automation scripts, and future services. If a request can reach an endpoint, that endpoint must be tested independently.
At minimum, verify:
- Authentication requirements
- Authorization and ownership boundaries
- Invalid input handling
- Supported HTTP methods
- Response code correctness
- Rate limiting
- Sensitive information disclosure
CORS should not be treated as protection for the API. It restricts certain browser requests but does not stop scripts, custom clients, or server-to-server communication.
Rentgen is not another general-purpose API client. It is an API discovery tool that starts with one working cURL request and systematically explores behavior beyond the expected path.
This is the first rule from The Power of Ten – Rules for Testing HTTP APIs: https://qaontime.com/research/the-power-of-ten-rules-for-testing-http-apis.html
Top comments (0)