API pentesting goes beyond the contract
Objects, fields, roles and API versions: four dimensions that are easy to overlook.
Map the operations
Compare API documentation with requests from a test client. For each route, record its method, data format, role and expected result. Documentation can lag behind implementation, so note discrepancies separately.
Objects and fields have separate boundaries
A user may be allowed to change their profile name but not their role. Check both access to the object and which fields may be modified. Use a reversible test value and a record that belongs to your test account.
Compare interface variants
Different API versions and methods may reach the same business function through different handlers. Compare the permitted variants: do they enforce the same authorization and input checks? Do not infer protection of an entire feature from a single route.
Describe the contract violation
In the report, identify the exact route, role, modified field and observed effect. Explain where a server-side check is needed: object permissions, allowed fields or a state transition. Then repeat the original scenario against the fixed version.