Learn how to use Param Miner to find hidden parameters that may help manipulate an API in unintended ways, revealing potential security flaws| Dana Epp's Blog
The Ten Most Critical API Security Risks| owasp.org