Welcome to the API Security Review Hub

These eight guides help you review AI automations that call APIs: what to check before you expand a workflow, how to read the evidence you have, and what to do next. Each guide is a practical review method, not a scan, a test result, or a safety verdict.

Table of Contents

Why UUIDs Do Not Prove API Object Authorization

An unpredictable object ID does not establish permission to access that object. Use a two-user review matrix to check whether an API response was actually authorized. Read the UUID authorization guide.

API Automation Resource Review: Frequency, Concurrency, Batch Size and Cost

Review the workload, not just a single request. Document how often an automation runs, how many requests overlap, how much each request asks for, and what each batch contains. Read the resource review guide.

API Inventory for AI Automation: A Copyable Register and Retirement Checklist

Record every API deployment your automation depends on: host and endpoint, deployed version, workflow dependency, data flow, accountable owner, and lifecycle decision. Copy the API register.

SSRF Review for URL-Accepting AI Automations: A Server-Fetch Worksheet

Find the server-fetch boundary first: which component requests a destination when a user supplies a URL, and what evidence supports that description. Use the SSRF worksheet.

GitHub Repository Webhook Recovery: What to Check Before and After Redelivery

GitHub does not automatically redeliver failed webhooks. Preserve the failure evidence first, then work through the checks that decide whether a redelivery attempt is warranted. Read the webhook recovery guide.

GitHub Conditional GETs: When to Replace or Reuse a Stored Response

Replace the stored body after a 200; reuse it after a 304. A 304 validates reuse rather than supplying replacement content. Read the conditional GET guide.

HTTP 429 Retry-After: Delay Seconds vs HTTP Dates

A 429 response may include Retry-After, as seconds counted from receipt or as an HTTP date. Neither form promises that another request will succeed. Read the Retry-After guide.

curl –resolve vs –connect-to: Change the Target, Keep URL Identity

Use –resolve for a known IP address and –connect-to for another connection hostname or port, while preserving the intended URL. Read the curl guide.

Frequently Asked Questions

Do these guides test live systems? No. They are review methods for reading documentation, records, and responses. Any proposed check belongs only in an environment you own or are explicitly authorized to test, using synthetic accounts and data.

Which guide should I start with? Start with the API inventory: you cannot review what you have not listed. Then work through authorization, resource use, and the SSRF worksheet for the automations that handle user-supplied URLs.

What if a check comes back inconclusive? Treat a missing answer as an open review question, not as evidence that the automation is safe or unsafe. Record it, note the evidence date, and re-check when the missing information arrives.

Start Your Review Here

Open the API inventory register, list the deployments your automation depends on, and work through the eight guides above one at a time.