awesome-api-security: Find API Security Tools and Learning Resources

Overview

awesome-api-security (also called awesome-apisec) is a curated collection of API security tools and resources, with an emphasis on open-source tools and community-benefiting material. It brings together references for people assessing, building, and hardening APIs, rather than providing a single scanner or security product.

The collection covers REST and GraphQL testing, API discovery and fuzzing, deliberately vulnerable practice targets, design guidance, specifications, and learning materials. Its breadth makes it useful as a starting point for finding resources, while each linked project or publication remains independently maintained.

Key Features

• Lists API security assessment tools for REST, GraphQL, and SOAP, including fuzzers, discovery utilities, and testing integrations.
• Collects API route, endpoint, and GraphQL wordlists for enumeration and fuzzing workflows.
• Links to intentionally vulnerable APIs and labs for hands-on practice.
• Includes checklists, cheatsheets, books, and reference material on API design and security.
• Provides learning resources such as workshops, courses, videos, podcasts, and conference links.
• Covers API description specifications including OpenAPI, AsyncAPI, GraphQL, RAML, and API Blueprint.
• States contribution criteria that favor relevant community resources and exclude promotional or proprietary submissions.

Use Cases

• A penetration tester assembling references for an API assessment can use the tool listings, wordlists, and enumeration guides as a discovery starting point.
• An application security team planning API testing can compare listed fuzzers and auditing tools, then evaluate the linked projects for its own environment.
• A developer learning API security can work through the vulnerable API targets, checklists, and training links.
• A security educator can find practice environments and supplementary material for a REST or GraphQL lesson.

Getting Started

Browse the README and choose a section for your task. There is no installation command because the repository is a resource collection, not a runnable application.

Alternatives

• awesome-web-security: It covers web security resources broadly, while awesome-api-security focuses specifically on API testing, defense, and practice materials.

Considerations

• GitHub marks the repository archived and read-only. It has had no recent commits or releases, and no issues or pull requests were closed or merged in the measured recent period.
• Although the repository has multiple contributors, its contribution history is heavily concentrated in one person. The archived status means there is no normal path for ongoing maintenance through this repository.
• The list contains links to independently maintained projects and resources, so availability, compatibility, and current accuracy vary. Verify each entry before relying on it.
• The repository is licensed under GPL-3.0. Check the license terms for reuse of the collection, and review the separate terms that apply to linked tools, books, and other materials.