Scoping: specs, roles, and environments
Good coverage starts with an OpenAPI/Swagger spec or Postman collection plus test credentials for at least two roles. Testers map every endpoint, parameter, and role combination before sending a single malicious request.
Authentication and authorization first
Most critical API findings are authorization failures: BOLA, broken function-level auth (admin endpoints reachable by users), and JWT weaknesses. Testers systematically replay requests across roles to find missing checks.
Business-logic abuse
Coupon stacking, negative quantities, race conditions on wallet debits, and workflow-skipping (jumping checkout steps) can't be found by scanners. Manual testers model your business rules and break them deliberately.
GraphQL-specific checks
Introspection exposure, deeply nested queries that cause denial of service, batching for credential stuffing, and field-level authorization gaps unique to schema-driven APIs.
Reporting and retesting
Expect CVSS-rated findings with exact reproduction requests, impact chained to business risk, and fix guidance. A proper engagement includes a retest of critical and high issues — untested fixes regress surprisingly often.