API Security Assessment Resume Project Example
An REST API security assessment that enumerated endpoints from OpenAPI specs, tested broken authentication and excessive data exposure in Burp Suite, and documented OWASP API Security Top 10 findings with replayable requests.
Free to start · No credit card required
ELENA ROSSI
Penetration Tester
Project
API assessment
Auth-focused- Assessed REST APIs against OWASP API Top 10.
- Exploited broken object-level authorization flaws.
- Documented JWT weaknesses and replayable PoCs.
Why this project is valuable
API offensive signal
API assessments show you test machine-to-machine attack surfaces—a growing pentest specialty distinct from network scanning alone.
Good ATS coverage
Supports OWASP API Security Top 10, REST API testing, JWT, Burp Suite, and authorization keywords.
Modern app relevance
Microservice and mobile backends rely on APIs hiring teams need tested.
Good interview depth
Discuss BOLA, mass assignment, rate limiting gaps, and token validation flaws.
Project overview
An API security assessment is credible penetration tester resume material because APIs expose authorization logic that automated scanners often miss without contextual abuse cases.
OpenAPI documentation seeded endpoint inventory; Burp Repeater fuzzed object IDs across JWT-authenticated calls, exposing BOLA on order and invoice routes; excessive data exposure returned full user records on list endpoints; findings mapped to OWASP API Top 10 with curl and Burp export evidence.
On a resume, that gives you ways to describe token scope analysis, HTTP verb tampering, pagination abuse, rate-limit bypass attempts, and developer-ready remediation snippets.
Architecture overview
Project flowAPI discovery
OpenAPI specs and mobile traffic in Burp catalogued routes, methods, and parameters.
Authentication review
JWT structure, expiry, and signature validation tested for weak signing and scope gaps.
Authorization testing
Object IDs swapped across user tokens to identify broken object-level access control.
Input and logic abuse
Mass assignment and unexpected HTTP verbs tested on sensitive mutations.
Rate and limit checks
Brute-force and enumeration attempts evaluated against throttling controls.
Report and remediation
Findings include replayable requests and API-specific fix guidance.
What this project includes
- OpenAPI-driven endpoint inventory
- JWT authentication and scope analysis
- BOLA and excessive data exposure testing
- HTTP verb and mass assignment checks
- OWASP API Top 10 mapping
- Replayable Burp and curl PoC exports
Tech stack
API testing stacks on Burp Suite and OWASP API guidance—not network pentest or SIEM tooling alone.
Burp Suite
Proxies mobile and web client traffic; replays and fuzzes API requests.
OWASP API Top 10
Structures finding categories specific to REST and GraphQL backends.
Postman
Organizes endpoint collections for systematic authorization test cases.
JWT
Target for algorithm, expiry, and claims manipulation during auth testing.
OpenAPI
Seeds route inventory and parameter expectations for coverage tracking.
curl
Exports minimal reproducible PoCs for developer remediation tickets.
Features implemented
BOLA coverage
Systematic object ID swaps across roles expose authorization gaps.
JWT weakness testing
Expired, altered, and none-algorithm tokens validate server-side checks.
Data exposure analysis
List endpoints checked for fields beyond minimum necessary response.
Verb tampering
Unexpected methods on routes reveal access control inconsistencies.
Rate limit evaluation
Authentication endpoints tested for brute-force and enumeration risk.
Developer-ready PoCs
curl reproduction steps speed fix verification.
Resume bullet examples
These bullets present API testing as authorization-focused offensive work.
- Performed REST API security assessment against OWASP API Top 10 using Burp Suite and OpenAPI-driven endpoint inventory across authenticated mobile clients.
- Identified broken object-level authorization on order and invoice routes by swapping object IDs across JWT-scoped user sessions with replayable PoC exports.
- Tested JWT validation for weak signing, excessive claims exposure, and missing expiry enforcement on sensitive mutation endpoints.
- Delivered API pentest report with CVSS-scored findings, curl reproduction steps, and developer remediation guidance for authorization middleware.
Skills demonstrated
This project demonstrates API penetration testing, JWT analysis, and OWASP API Top 10 coverage.
API Offensive
Discovery
Reporting
ATS keywords extracted from this project
Emphasize API and authorization keywords over network or SIEM terms.
Interview questions based on this project
API assessments invite BOLA and JWT questions.
How is API testing different from web app testing?
APIs often lack UI context, so authorization flaws like BOLA require systematic token-scoped object ID swaps across every route.
What JWT issues did you find?
Some services accepted tokens with expired claims when clock skew was mishandled; others returned excessive user fields on list endpoints.
How did you track coverage?
OpenAPI routes became a checklist; each method and role combination got authorization and input abuse cases.
How would you extend the assessment?
Add GraphQL batching abuse, webhook SSRF checks, and automated schema diff on each release.
Common mistakes
API work needs authorization abuse cases, not just Nmap service discovery.
Stay offensive—findings and PoCs, not log correlation rules.
Coverage tracking proves systematic testing, not random requests.
Lead with BOLA, JWT, and excessive data exposure for API roles.
FAQ
Is an API security assessment a good pentest project?
Yes. API testing is increasingly required alongside traditional web engagements.
Can I use a vulnerable API lab?
Yes. OWASP crAPI or similar labs work if methodology and reports reflect your own analysis.
Should I mention OWASP API Top 10?
Yes. It is the standard framework clients expect for API assessments.
How many bullets should I use?
Two to four bullets on inventory, BOLA/JWT findings, methodology, and reporting.
Turn project details into resume evidence
Use this API assessment to strengthen your penetration tester resume
Present OWASP API testing, JWT analysis, and recruiter-friendly authorization findings with stronger keyword alignment.
Free to start · No credit card required