API Description & Discovery Labs
API contracts reduce guesswork. They expose operations, message shapes, parameters, schemas, response models, bindings and—in some formats—authentication requirements. For an authorised penetration tester or integration engineer, that information becomes a structured reconnaissance source.
Use the supplied fictional Northstar Training Services fixtures. Do not direct test traffic at a third-party or production API unless the system owner has explicitly authorised the target, time window and test techniques.
Track outcomes
By completing the track, you will be able to:
- distinguish message formats from service-description formats;
- extract a testable API surface from XML, YAML and GraphQL schema documents;
- relate schemas and type systems to input-validation and data-exposure tests;
- identify authentication, authorisation, error-handling and resource-consumption test cases;
- produce a prioritised test charter with reproducible evidence requirements.
Lab sequence
| Code | Lab | Primary artefact | Duration |
|---|---|---|---|
| LAB-API-101 | SOAP Message & Schema Analysis | SOAP 1.2 XML + XSD | 60 min |
| LAB-API-102 | Swagger / OpenAPI Contract Review | OpenAPI 3.1.2 YAML | 75 min |
| LAB-API-103 | GraphQL Schema & Query Security | GraphQL SDL + operations | 75 min |
| LAB-API-104 | WSDL Service Contract Mapping | WSDL 2.0 XML | 60 min |
| LAB-API-105 | WADL Legacy API Discovery | WADL XML | 60 min |
| LAB-API-190 | API Contract Reconnaissance Capstone | Cross-format evidence pack | 90 min |
Working method
For every format, use the same six-stage workflow:
- Identify the document type, version and namespace.
- Inventory operations, resources, fields, parameters and representations.
- Trace authentication, authorisation and trust boundaries.
- Constrain inputs using the contract or schema.
- Hypothesise security and reliability test cases.
- Evidence the result with source locations, expected behaviour and retest criteria.
Required tools
A text editor with XML/YAML/GraphQL syntax highlighting is sufficient. Optional tools include an XML validator, an OpenAPI linter, GraphQL-aware editor tooling and a local static web server. No cloud account or production credential is required.