API Security Testing Tool

Only Test Endpoints You Are Authorised to Test

This tool sends real HTTP requests to the URL you enter — including, if you enable the input-validation check, a POST carrying deliberately malformed data. Point it at your own APIs, a staging environment, or a target you have written permission to assess. Probing third-party infrastructure without authorisation is unlawful in most jurisdictions regardless of how light the traffic is.

What This Tool Checks

• Reachability. Whether the endpoint responds at all, and with what status — the baseline every other check depends on.
• Authentication signal. Whether the response carries a WWW-Authenticate challenge, indicating the endpoint expects credentials rather than serving data to anonymous callers.
• CORS policy. The Access-Control-Allow-Origin value. A literal * on an authenticated API is a common and serious misconfiguration — it invites any origin to read responses.
• Security headers. Presence and value of the standard hardening headers, each of which closes off a specific, well-understood attack class.
• Input validation. Sends a deliberately invalid payload and reports whether the API rejects it. An endpoint that returns 200 for garbage input is usually one that is not validating at all.

The Browser Sandbox Limits These Results — Read This Before Trusting Them

This is the most important caveat on the page, and most browser-based scanners do not state it. Because the tool runs as JavaScript in a web page, it is bound by the same cross-origin rules as any other site. When you test an API on a different origin, the browser only exposes the response headers that the server explicitly permits via Access-Control-Expose-Headers. For a typical API that does not opt in, the tool cannot read the headers at all — and a header it cannot read is indistinguishable from a header that is absent.

The practical consequence: a "missing header" finding against a cross-origin API may be a false positive. Treat these results as a fast triage signal, not as an audit. Confirm anything that matters with a request that is not subject to CORS:

curl -sSI https://api.example.com/v1/resource

Results are most reliable when the endpoint is on this origin, when the API already sends permissive CORS, or when it is a public endpoint designed for browser access.

The Security Headers, and What Each One Actually Stops

• Strict-Transport-Security — forces HTTPS for future requests, closing the downgrade window an attacker on the network can otherwise use.
• X-Content-Type-Options: nosniff — stops the browser second-guessing your Content-Type. Without it, a JSON response containing attacker-controlled text can be interpreted as HTML and executed.
• X-Frame-Options (or CSP frame-ancestors) — prevents your responses being framed by another site, which is the basis of clickjacking.
• Content-Security-Policy — constrains what a page may load and execute. The strongest single defence against cross-site scripting.
• Referrer-Policy — stops full URLs, which frequently contain tokens and identifiers, leaking to third parties in the Referer header.

What This Tool Does Not Do

Being explicit about scope is more useful than implying coverage that is not there. This is a header and behaviour spot-check. It does not test for:

• Broken object-level authorisation (BOLA/IDOR) — the top entry in the OWASP API Security Top 10, and the one that causes the most real breaches. Finding it requires two accounts and an understanding of your object model.
• Injection — SQL, NoSQL, command, or template injection all need payload fuzzing against parameters the tool knows nothing about.
• Business logic flaws — negative quantities, race conditions on checkout, replayable state transitions. No scanner finds these.
• Rate limiting and resource exhaustion — deliberately not tested, because testing it means generating abusive traffic.
• Authentication strength — it detects whether a challenge exists, not whether the scheme behind it is sound.

For depth beyond a spot-check, use an intercepting proxy such as OWASP ZAP or Burp Suite against a staging environment, and work the OWASP API Security Top 10 as a checklist.

Where This Fits in a Workflow

Its value is speed. Before a service goes to production, before you sign off a third-party integration you are entitled to assess, or when triaging an inherited API you have never seen, this answers "are the basics in place?" in seconds — and a missing nosniff or a wildcard CORS policy is almost always a symptom of a wider gap in how the service was configured. If the endpoint you are testing returns bearer tokens, the JWT Decoder will show you what claims and expiry those tokens carry.

Privacy

The request goes directly from your browser to the endpoint you specify. Tech:443 has no backend, so no URL, header, or response you test is proxied, logged, or stored anywhere by this site.