IDENTIFICATION OF SECURITY VULNERABILITIES IN APPLICATION PROGRAM INTERFACES Russian patent published in 2021 - IPC G06F11/30 G06F21/57 

FIELD: computer technology.

SUBSTANCE: method performed by a computer system to automate the detection of security vulnerabilities of an application program interface (hereinafter – API) contains: receiving information about the API of a third-party system; receiving authentication flows for the API; generating an API specification based on the information received, wherein the API specification describes API endpoints; for each of API endpoints described in the API specification, for each of authentication flows for the API, determining security vulnerabilities of the API endpoint; for each specific security vulnerability, performing the first audit task for the API endpoint to determine, whether the API endpoint is vulnerable, and performing the second audit task for authentication flow to determine, whether authentication flow is vulnerable; recording the results of the first and second audit tasks performed; generating a scan report for the API; sending the scan report to the third-party system.

EFFECT: providing the possibility of identification of security vulnerabilities in application program interfaces.

18 cl, 5 dwg