About OWASP API Security Testing Framework
Description
The OWASP API Security Testing Framework (ASTF) is a specialized security testing tool designed to identify vulnerabilities in APIs based on the OWASP API Security Top 10. In an era where APIs form the backbone of modern applications, this framework enables automated security validation, making it easier to integrate security testing into development pipelines.
Project Purpose
Modern applications rely heavily on APIs, but specialized tools for testing API security are lacking. The ASTF fills this gap by providing:
Getting Involved
The API Security Testing Framework welcomes contributions from the community. Here’s how you can get involved:
Join us on GitHub to contribute.
Licensing
This project is licensed under the Apache 2.0 License.
Getting Started
# Clone the repository
git clone https://github.com/OWASP/api-security-testing-framework.git
# Build the project
mvn clean install
# Run a basic scan
java -jar astf.jar --target http://example-api.com --auth-token TOKEN
For more detailed instructions, please refer to our GitHub repository.
Project Resources
Project Information
Incubator Project
Classification
Incubator
OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.
SlackOWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.
© 2026, OWASP Foundation Inc. All rights reserved.