Identify API assets and actors

An API exposes application capabilities directly. Start by listing what callers can read, change, trigger, or spend.

Include anonymous callers, users, administrators, mobile apps, background jobs, partners, and third-party services. For each actor, record the intended operations and sensitive data. This becomes the authorization and testing map.

Imagine an invoices API used by customers, support staff, and a nightly accounting job. A support account that can issue refunds turns a useful integration into a money-moving security boundary.

Record data sensitivity and maximum loss beside each operation. That evidence separates a harmless invoice search from a refund path that needs stronger approval, logging, and recovery controls.

Create an actor-to-operation table for the invoices API. Prove it is useful by adding a compromised support account and recording which reads, writes, and refunds must fail.