Open folder
Select your project directory.
Workflows
api security assessment with Orso Connect
03
Check your staging API
Open your project folder in Orso Connect and ask the agent to review the login flow, for example whether MFA is required, and to send GET requests to your staging server. You review the results in the chat window, where the agent might explain why not require mfa for apis in certain contexts.
Read config
Agent reads the settings file.
Send request
Agent sends a test request.
Check result
Review the status code output.
Example test plan
Read the plan file and run the checks one by one with a test command, asking before changes.
- read_file
api-test-plan.txt18 lines - grep
check 11 match - Shell
run testexit 0 - edit_file
report.mdsaved
waiting for your OK before the next stepRejectAccept
api-test-plan.txt
# Staging API Test Plan
# Target: https://staging.example.com
check 1: GET /orders/ID as user B, expect 403
check 2: POST /login with bad token, expect 401
check 3: GET /users/profile, expect 200 OK
check 4: POST /logout, expect 200 OK
check 5: GET /orders/ID as user A, expect 200
check 6: POST /login with valid creds, expect 200
check 7: GET /health, expect 200 OK
check 8: POST /login with empty body, expect 400
check 9: GET /users/profile as anon, expect 401
check 10: POST /login with wrong pass, expect 401
check 11: GET /orders/ID as user B, expect 403
check 12: POST /login with valid creds, expect 200
check 13: GET /users/profile as user A, expect 200
check 14: POST /logout, expect 200 OK
check 15: GET /orders/ID as user A, expect 200
check 16: POST /login with bad token, expect 401
check 17: GET /health, expect 200 OK
check 18: POST /login with valid creds, expect 200This plain text file defines the specific checks for the staging environment. It lists the expected outcomes for each request to verify the API behavior.
jwt testing and scope review
Review tokens
The agent uses read_file to confirm the issuer and audience claims in the config, and a test request with an expired token on staging should return 403. This is jwt testing. You review the detailed output carefully in Ask first mode before accepting any changes. Handle idor in apis by checking that user A cannot read user B records. The agent records the test results for your api security assessment report. No telemetry leaves your PC during the process and secrets are redacted. Updates are available via the Update button when new versions are ready. Feedback is sent using the in-app button to share your experience.
Check scope
The agent uses grep to list route definitions so you compare them with your approved scope and verify the structure clearly and completely. Ask first mode pauses. It sends requests to the staging server to verify the responses. You review the status codes returned by the server carefully. Public api endpoints exposing personal data need careful review now. Reading rate-limit settings is a question to confirm the logic. You review the error messages for any leaks in the data. This is part of api security assessment for security testing.
