API VAPT Checklist for Fintech Applications
Fintech APIs are tested under tighter constraints than typical APIs — auth flows interact with NPCI, settlement APIs must be idempotent, and one missing rate-limit can cost real money. This checklist combines OWASP API Top 10 with the payment-specific test cases we see Indian fintech acquirer banks asking for.
The Checklist
OWASP API Top 10 — must cover all
- API1:2023 Broken Object Level Authorization (BOLA) — every endpoint that uses object IDs
- API2:2023 Broken Authentication — token issuance, refresh, revocation, cross-tenant
- API3:2023 Broken Object Property Level Authorization (BOPLA) — over-permissive responses, under-restrictive writes
- API4:2023 Unrestricted Resource Consumption — rate-limiting, response size, query-complexity
- API5:2023 Broken Function Level Authorization — admin/standard function gating
- API6:2023 Unrestricted Access to Sensitive Business Flows — KYC bypass, registration abuse
- API7:2023 Server Side Request Forgery — webhook receivers, image uploads, integration callbacks
- API8:2023 Security Misconfiguration — default creds, verbose errors, CORS, headers
- API9:2023 Improper Inventory Management — unused endpoints, dev endpoints exposed, undocumented APIs
- API10:2023 Unsafe Consumption of APIs — partner integrations, trust boundary issues
Auth & session
- Token expiry tested (access + refresh)
- Revocation tested (logout, password change, force-logout)
- MFA bypass attempts (recovery flows, backup codes, social-login fallback)
- Session fixation, replay and device-binding tested
- OAuth flows tested for PKCE enforcement and code/token leakage
Payment-specific tests
- Idempotency-key replay — repeated submissions don't double-charge
- Settlement race conditions (concurrent payouts, refunds, reversals)
- Amount tampering — client-supplied amount vs server-computed
- Currency / decimal manipulation
- BIN / PAN / Aadhaar partial-exposure in logs and responses
- Webhook authenticity — signature verification, replay protection
UPI / NPCI-specific (where applicable)
- UPI intent tampering (deep-link manipulation on Android)
- Device-binding integrity (re-binding without OTP)
- OTP/2FA replay, brute-force, MITM
- Common-library exploitation (NPCI SDK fingerprinting)
- Sandbox-vs-prod misconfig (sandbox creds active in prod)
KYC / consent / data
- KYC bypass via mule / synthetic identity
- Account Aggregator consent tampering (scope, expiry)
- Video-KYC liveness bypass
- Document upload — file-type / payload / SSRF testing
- Customer data retention / erasure obligations evidence
Infrastructure & ops
- TLS configuration (no TLS 1.0/1.1, strong ciphers, HSTS)
- Rate-limit at the API gateway (per-IP, per-token, per-customer)
- WAF / API-protection deployment evidence
- Logging: 100% auth events, 100% money-movement events, retention >= 6 months
- Anomaly detection — failed-auth velocity, geo-velocity, device-velocity
Frequently asked questions
Is OWASP API Top 10 enough for a fintech API VAPT?
It's necessary but not sufficient. Indian fintech APIs interact with NPCI, RBI DPSS systems and acquirer banks — each of which has additional test cases (idempotency, settlement race, sandbox-prod isolation) that OWASP doesn't cover directly.
Do we need separate VAPT for partner / B2B APIs?
Yes. Partner APIs typically have weaker auth (long-lived API keys, IP allow-listing) and looser observability. They're the most common breach vector and need their own scope.
How long does a fintech API VAPT take?
Single product (web + mobile + API): 3-4 weeks. Multi-product platform (PA + PG + UPI + AA): 6-8 weeks. We typically run weekly status calls with engineering during the engagement.
What's the most common API finding you see?
Broken Object Level Authorization (BOLA) — the API accepts object IDs from one user and returns another user's data. Found in 70%+ of first-time fintech VAPTs.
Will the report be accepted by acquirer banks?
Yes — our reports as a CERT-In Empanelled auditor are accepted by NSE, BSE, NPCI sandbox, RBI inspections and all major Indian acquiring banks.
Need help executing this?
Talk to Digital Defense — India's CERT-In Empanelled cybersecurity team.
Book a consultation