skills.rest
braydos-h
braydos-hCOMMUNITY
Explore all skills by this author →
GitHub

performing-api-security-testing-with-postman

Builds Postman collections and Newman pipelines to test APIs for OWASP API Security Top 10 vulnerabilities.

4|Updated Apr 28, 2026
Search Tags:#ci/cd#owasp#security testing#postman#api security#newman#bola
One-click install
npx skills add https://github.com/braydos-h/BreachPilot --skill performing-api-security-testing-with-postman-braydos-h
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-api-security-testing-with-postman
Source: https://github.com/braydos-h/BreachPilot/tree/main/skills/performing-api-security-testing-with-postman
Command: npx skills add https://github.com/braydos-h/BreachPilot --skill performing-api-security-testing-with-postman-braydos-h

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Manually probing APIs for authorization flaws, injection, and data exposure is slow and inconsistent. This Skill provides a structured workflow for building repeatable Postman security test collections that cover the OWASP API Security Top 10 and run automatically in CI/CD pipelines via Newman. ## Core Features & Use Cases - OWASP API Top 10 Test Collections: Pre-built test script patterns for BOLA, broken authentication, excessive data exposure, BFLA, mass assignment, and rate limiting. - Multi-Role Environment Testing: Environment templates and pre-request scripts for testing as unauthenticated, regular user, and admin roles with automatic token handling. - CI/CD Integration: Newman CLI commands and GitHub Actions workflow examples that fail builds on security test regressions, plus a Python agent that generates BOLA and injection test collections programmatically. - Use Case: A development team imports their OpenAPI spec, applies the security test scripts to every endpoint, and runs the collection via Newman on each pull request to catch authorization regressions before merge. ## Quick Start Ask the AI to generate a Postman security test collection for your API's endpoints covering BOLA and authentication checks, then run it with Newman against your staging environment.

Frequently Asked Questions about performing-api-security-testing-with-postman

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test APIs for OWASP API Security Top 10 with Postman?▼

Create a Postman collection with test scripts that assert expected denial codes for BOLA (403/404), invalid token rejection (401), sensitive field absence, and mass assignment rejection. Run the collection across environments for unauthenticated, regular user, and admin roles.

How to run Postman security tests in CI/CD with Newman?▼

Install Newman with npm install -g newman, then run newman run collection.json -e environment.json with cli, htmlextra, and junit reporters. Add the command to a GitHub Actions workflow so failing security assertions block pull request merges.

How do I test BOLA and IDOR vulnerabilities in Postman?▼

Authenticate as one user, then request another user's resource ID and assert the response is 401, 403, or 404. The included agent script can generate a full BOLA collection from a list of endpoints and two user tokens.

Can Postman integrate with OWASP ZAP for API security testing?▼

Yes. Configure OWASP ZAP as a local proxy on localhost:8080 and route Postman traffic through it, so ZAP passively scans every request while Postman executes the collection. This combines scripted assertions with automated vulnerability scanning.

When should I not use Postman for API security testing?▼

Do not run Postman security tests against production APIs without explicit authorization, since the collections send potentially malicious payloads. Use staging environments, and avoid hardcoding real tokens in shared collections.

Related Skills

Explore More Software Engineering Skills→
sfc-gh-miwhitakersfc-gh-miwhitaker
3

cowork-only-users

Provision CoWork-only Snowflake users without Snowsight or SQL access.

Community
Intermediate
dnvitidnviti
10

vulnerability-create

Generate structured remediation tasks from security vulnerability findings with severity classification.

Community
Intermediate
BagelHoleBagelHole
46

dast-scanning

Perform DAST scans on web applications and APIs with OWASP ZAP.

Community
Intermediate
AcczdyAcczdy
2

performing-api-fuzzing-with-restler

Fuzz stateful REST APIs with RESTler to uncover security and reliability bugs.

Community
Advanced