# API authorization: test the actor, object and action together

Source: https://www.web3sec.news/blog/api-authorization-review-runbook
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Map actor, object, action, tenant and state.
- [ ] Inventory legacy, batch, export and asynchronous paths.
- [ ] Enforce policy on the server at every protected operation.
- [ ] Test synthetic users across two tenants.
- [ ] Verify side effects and deny-safe failure behavior.

## References
- [OWASP: authorization cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html)
- [OWASP: REST security cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html)