XTRIKE API DESK
Live API telemetry and OpenAPI 3.1 contracts stay current. The six verification studios below are the deterministic validation desk. The proof engine scores reachability and role-differential replay—it is an evidence verifier, not an unverified guess.
Each scanner alert is normalized into a canonical finding record. Open the Proof Studio or launch a live role-differential replay so the independent verifier can bind a 6-Point Proof Contract to `commit 9f4c2a1e`.
Major validation updates & workbenches
OpenAPI 3.1 contract checks, controller AST predicate analysis, Z3 security claims, and role-differential replays from the latest build. A confirmed badge means all 6 points of the Proof Contract passed deterministically.
Proof-Driven API Validation Engine
6-stage OpenAPI & gateway ingestion to role-differential runtime proof pipeline, Z3 tenancy/JWT claim verification, 10 pluggable API analyzers, mutation testing, and OWASP API Top 10:2023 reference catalog.
API Scan, Fuzzer & Post-Scan Proof Studio
Full-width 1360px API request workbench, OWASP API Top 10 fuzzer, JWT token decoder, OpenAPI 3.1 contract auditor, and automated post-scan evidence verification.
BOLA / IDOR Cross-Tenant Authorization Matrix
Controlled multi-principal replay across Tenant A, Tenant B, Member, and Unauthenticated contexts to verify object-level ownership predicates.
BFLA Function-Level Authorization Hunter
Inspects administrative and privileged routes across HTTP verbs (GET, POST, PUT, DELETE) to detect missing role middleware and method-override drift.
OpenAPI 3.1 & Shadow API Drift Studio
Compares live API gateway traffic against declared OpenAPI 3.1 schemas to uncover shadow/zombie endpoints, unvalidated mass-assignment fields, and PII exposure.
JWT Token Security & Algorithm Guard
Verifies RS256/ES256 algorithm pinning, rejects alg:none and HMAC/RSA key confusion, and audits token expiration, issuer, and audience claims.
OWASP API Security Top 10 (2023) Verification Coverage
Mapped to MITRE CWE, NIST NVD/CVE, and NIST SP 800-53 Rev. 5 controls inside the Python `validation_engine` package.