A comprehensive automated testing framework for detecting API security vulnerabilities based on the OWASP API Security Top 10.

The OWASP API Security Testing Framework (ASTF) helps security professionals and developers identify vulnerabilities in their APIs through automated testing. Built with enterprise needs in mind, it provides detailed security analysis and integrates with modern CI/CD pipelines.

• Automated detection of API-specific vulnerabilities
• Comprehensive test coverage of OWASP API Security Top 10
• Support for REST, GraphQL, and gRPC APIs
• CI/CD integration capabilities
• Detailed vulnerability reporting
• Custom rule creation
• Remediation guidance

• Java 17 or higher
• Maven 3.6+

# Clone the repository
git clone https://github.com/OWASP/www-project-api-security-testing-framework.git

# Build the project
cd api-security-testing-framework
mvn clean install

# Run a basic scan
java -jar target/api-security-testing-framework-1.0-SNAPSHOT.jar scan \
  --target https://api.example.com \
  --auth-header "Authorization: Bearer YOUR_TOKEN"

api-security-testing-framework/
├── src/
│   ├── main/
│   │   ├── java/org/owasp/astf/
│   │   │   ├── core/          # Core scanning engine
│   │   │   ├── testcases/     # API security test cases
│   │   │   ├── integrations/  # CI/CD integrations
│   │   │   └── cli/           # Command line interface
│   │   └── resources/         # Configuration files
│   └── test/                  # Test cases
├── docs/                      # Documentation
└── examples/                  # Usage examples

For more detailed information, please refer to our Documentation.

For detailed understand on the framework, please refer to our Framework Overview.

Please refer to our Architecture.

We welcome contributions from the community! Please see our Contributing Guidelines for more information on how to get involved.

See our Project Roadmap for upcoming features and plans.

This project is licensed under the Apache License 2.0 - see the LICENSE file for details.

This project adheres to the OWASP Code of Conduct. By participating, you are expected to uphold this code.

• Project Leader: [Govindarajan Lakshmikanthan]
• GitHub: @GovindarajanL
• OWASP Project Page: OWASP API Security Testing Framework
• Slack: #project-api-security-testing-framework