Authorization
Compare object and function access across users, roles, and tenants. Use the model to suggest BOLA, IDOR, and BFLA cases worth checking.
A security API for the tests you need to reason through
API penetration testing starts with better questions.
Give the model an endpoint, a role, and the behavior you expect. Explore the cases that could break that boundary, then test and verify them in your own environment.
The workflow
Context in.
Test cases out.
Use an OpenAI-compatible chat-completion request. Your existing runner or proxy stays in charge of execution.
01 / Describe
Provide the route, request shape, authorization roles, and expected behavior.
02 / Investigate
Ask for boundary cases and the evidence needed to confirm each one.
03 / Verify
Run authorized tests in your environment and review the actual responses.
Request shape
Fits the tools you already use.
Send endpoint context as a message using the standard chat-completions format. The example shows the request shape; test execution remains in your own workflow.
Explore the quickstartfrom openai import OpenAI
client = OpenAI(
base_url="https://app.zerodayapi.com/v1",
api_key="YOUR_API_KEY",
)
response = client.chat.completions.create(
model="your-model-id",
messages=[{
"role": "user",
"content": "For GET /users/{id}, suggest "
"authorization tests for two roles "
"and what evidence would confirm them."
}],
)Where to start
Three boundaries worth testing.
Use these prompts as starting points for authorized API security testing, then check every proposed finding against real responses.
Authentication
Reason through token scope, session state, and the requests that should fail before an authenticated flow begins.
Input boundaries
Explore field constraints, state transitions, and unexpected values from the request and response examples you provide.
FAQ
What the API does today.
Does ZeroDayAPI scan my endpoints?
No. The API accepts chat-completion requests. Your test runner, proxy, or engineer sends requests to the target and verifies the result.
Can I use an OpenAPI or GraphQL schema?
Yes. Include relevant schema excerpts, roles, and example requests in your prompt. Automatic schema ingestion is not part of the current API.
Does this replace a penetration tester or DAST tool?
No. Use the model to explore test ideas and interpret evidence; use your existing tools and review process to confirm findings.