在开发周期中的哪些点我们应该测试我们的api吗？
you can test apis at any time, and the sooner the better. unlike a “final” application penetration test intended to verify the overall security of a web application prior to launch, the sooner you know about defects in your apis the sooner you can rectify them. it’s also important to update and retest your apis on a regular basis (e.g., once per quarter) so that you don’t end up with a growing “snowball” of expensive-to-fix vulnerabilities as your apis are updated over time.
no, an api pen test is looking to test the quality of the application by examining whether the apis it uses are secure. it is about identifying vulnerabilities in the apis, not validating whether the overall application can withstand an attack.