API Scan & Post-Scan Proof Workbench (1360px)Target: api.acme.com/v2 · 83 Endpoints
API Security Scanner & Role-Differential Proof Validator
1. Target & Auth Matrix Setup
OpenAPI 3.1 + SARIF2. Audited API Routes (8 / 83)
100% MappedPOST /api/v2/auth/loginAPI4:2023
Auth: PublicLikely (Rate Limit)
GET /api/v2/users/{id}API1:2023
Auth: Bearer JWTConfirmed (BOLA)
PUT /api/v2/users/{id}API3:2023
Auth: Bearer JWTConfirmed (BOPLA)
GET /api/v2/admin/usersAPI2:2023
Auth: Admin JWTConfirmed (JWT alg:none)
GET /api/v2/admin/users/{id}API3:2023
Auth: Admin JWTConfirmed (Hash Leak)
POST /api/graphqlAPI8:2023
Auth: Optional JWTConfirmed (Introspection)
GET /api/v2/users/meAPI8:2023
Auth: Session/JWTConfirmed (CORS)
GET /api/v2/products/searchAPI8:2023
Auth: Bearer JWTFalse Positive (Safe Bind)
Endpoints Audited
83
REST + GraphQL
Confirmed w/ Proof
6
3/3 Replay Verified
Likely (Env Check)
1
API-004 Rate Limit
False Positives Filtered
1
API-009 Bound SQL
Post-Scan Automated Proof Verification (PTES / NIST 800-115)
Select any scanner finding below to inspect its static controller AST verdict, role-differential runtime replay, and 6-Point Proof Contract.
API-001 · API1:2023 (CWE-639)CONFIRMED
BOLA — Cross-Tenant User Record Access via Path ID
Stage D1 · Static Route & ORM Predicate Check
Missing `AND users.tenant_id = :jwt_tenant_id` in SQLAlchemy query
File: services/users/controllers/user_controller.py:L42–L68
Stage D2 · Controlled Multi-Role Runtime Replay
GET /api/v2/users/1001 with user_1000 JWT -> HTTP 200 OK (leaks ssn_last4, salary)
3 / 3 deterministic replays matched (100%)
Stage F · Verified Remediation & Contract Test
Add `.filter(User.id == id, User.tenant_id == current_principal.tenant_id)` + Pytest contract `test_get_user_cross_tenant_denied`