API Security Testing for E-commerce and Retail
E-commerce APIs are under automated attack every day. Bots enumerate order IDs to harvest customer data, scripts manipulate cart payloads to alter prices, and coupon abuse tools extract discount value at scale. Unlike targeted breaches, these attacks run continuously against every publicly accessible storefront API.
ApyGuard tests your cart, checkout, order, and account APIs against the full OWASP API Security Top 10 -- including business logic abuse patterns specific to retail that generic scanners miss entirely.
Why E-commerce APIs Are Under Constant Attack
Retail APIs are publicly accessible by design -- customers, mobile apps, and third-party integrations all need to reach your cart and checkout endpoints. That public accessibility, combined with high transaction volume and direct financial value, makes e-commerce APIs a permanent target for automated exploitation.
The attacks are not sophisticated. Order ID enumeration just requires changing a number in a URL. Cart price manipulation requires inspecting one legitimate checkout request and modifying a price field. Coupon stacking requires submitting two promotion codes and observing whether both are applied. Automated tooling runs these patterns against thousands of storefronts simultaneously.
The business impact is concrete: revenue loss from discount abuse, customer data exposure from order enumeration, fraudulent orders from price manipulation, and stock exhaustion from inventory reservation bots. ApyGuard finds these vulnerabilities before they are exploited.
The E-commerce API Vulnerabilities We Find Most Often
These six categories account for the majority of critical and high findings in retail API security reviews.
Broken Object Level Authorization
Order and cart ID enumeration
An authenticated customer changes an order ID, cart ID, or return request ID in the URL and reads another customer's purchase history, delivery address, or payment method. Sequential numeric IDs make enumeration trivial.
Unrestricted Access to Sensitive Business Flows
Discount and coupon abuse at scale
Checkout APIs that accept coupon codes, referral bonuses, or loyalty points lack controls against automated application. Attackers run scripts that apply the same discount code thousands of times, stack incompatible promotions, or abuse referral flows to generate credits.
Broken Object Property Level Authorization
Price and quantity field manipulation
Cart update and checkout APIs accept fields they should not -- unit price, applied discount, shipping cost. A buyer submits a modified cart payload with a lower price and the order is processed at that price if the server trusts client-supplied values.
Broken Function Level Authorization
Customer access to admin inventory and pricing
Product management, bulk pricing update, and inventory adjustment endpoints designed for internal staff or marketplace sellers are accessible with standard customer tokens by changing the HTTP method or request path.
Broken Authentication
Account takeover on checkout and loyalty flows
Password reset APIs, guest checkout token endpoints, and loyalty account flows accept weak tokens, skip rate limiting on verification codes, or allow credential stuffing against email/password login without lockout.
Unrestricted Resource Consumption
Inventory reservation and gift card brute force
Add-to-cart and reserve-inventory endpoints lack rate limits, allowing bots to reserve all stock of a limited-release product. Gift card and store credit balance-check endpoints without rate limiting enable brute-force enumeration of valid codes.
Business Logic Testing: What Generic Scanners Miss
OWASP API6 -- Unrestricted Access to Sensitive Business Flows -- is the category traditional scanners cannot test because it requires understanding what your API is supposed to do. ApyGuard generates test cases based on your actual promotion, cart, and checkout schemas.
Discount stacking
Tests whether multiple exclusive coupon codes can be applied to a single order simultaneously.
Price manipulation
Sends cart payloads with modified unit prices, shipping overrides, and tax exemption flags to test server-side price validation.
Inventory reservation abuse
Tests rate limits on add-to-cart and reserve-stock endpoints to verify bots cannot hold inventory without purchasing.
Referral and loyalty abuse
Tests whether referral bonus flows, loyalty point accrual, and store credit endpoints can be exploited for repeated credit generation.
How ApyGuard Tests Storefront and Checkout APIs
Import your storefront API spec
ApyGuard reads your OpenAPI spec for cart, checkout, product, and account endpoints. Use the browser extension to capture additional routes -- internal admin APIs, seller portal endpoints, and third-party integration routes that are rarely documented.
Configure customer and staff credentials
Provide tokens for each role: standard customer, marketplace seller, store admin. ApyGuard tests BOLA and BFLA by sending requests across role boundaries and BOLA by substituting one customer's resource IDs with another's.
AI generates retail-specific attack requests
Attack payloads target your actual order and product ID formats, your specific coupon code patterns, and the exact fields your cart and checkout APIs accept. Not generic payloads -- requests adapted to how your specific storefront API is structured.
Receive findings prioritized by business impact
Every finding is categorized by OWASP category and severity. Business logic findings include the specific flow that was exploited -- which promotion, which endpoint, which field -- so your team can reproduce and fix it immediately.
Missing endpoints in your spec? Use the ApyGuard browser extension to capture all active storefront routes -- including undocumented admin and seller portal endpoints.
Test Before Every Release and Promotional Campaign
E-commerce teams ship frequently -- sale events, new promotion logic, checkout redesigns, new payment methods. Each change is an opportunity to introduce a business logic gap or an authorization regression. ApyGuard integrates into your CI/CD pipeline and runs a full security scan on every pull request.
Running a scan before a major sale event is especially important. New discount logic, referral programs, and limited-release inventory flows are exactly the high-value targets that attackers probe first when a campaign goes live.
- name: Storefront API Security Scan
uses: apyguard/pentest-action@v1
with:
api-spec: ./openapi.yaml
api-url: ${{ secrets. STAGING_API_URL }}
api-key: ${{ secrets. APYGUARD_KEY }}
fail-on: highFrequently Asked Questions
Does ApyGuard test unauthenticated guest checkout flows?
Yes. ApyGuard tests both authenticated and unauthenticated endpoints. Guest checkout flows, public product endpoints, and unprotected cart APIs are tested without credentials. You configure which endpoints require authentication during scan setup.
How does ApyGuard test business logic vulnerabilities like discount abuse?
ApyGuard sends requests that mimic automated abuse patterns: applying the same discount code multiple times, submitting cart payloads with modified price fields, and combining promotions that should be mutually exclusive. These tests are generated based on the parameter schemas in your API spec -- if your checkout API accepts a discount_code field, ApyGuard tests what happens when that field is manipulated.
Can ApyGuard test our payment processing integration?
ApyGuard tests the API layer of your payment integration -- the endpoints your frontend calls to initiate a payment, apply a promo, or retrieve a payment method. It does not send test transactions to payment processors. Scan against your staging environment where payment processing is mocked or uses sandbox credentials.
We use a third-party platform (Shopify, Magento, etc.). Does ApyGuard still apply?
If you have a custom API layer -- a headless storefront, a custom checkout service, a bespoke loyalty or inventory API -- ApyGuard tests that layer. Hosted platform APIs (Shopify Storefront API, Magento REST API) can also be tested if you have API credentials and a staging environment, but custom business logic built on top of these platforms is typically the highest-risk surface.
Related industries
Explore similar authorization challenges
These industries face overlapping API risks around object-level authorization, role boundaries, and sensitive workflow abuse.
Secure Your Storefront Before the Next Sale Event
Import your checkout API spec and run your first e-commerce security scan in under 30 minutes. No credit card required.
Read the API security best practices guide.