Security begins by identifying assets, trust boundaries, attackers, entry points, and possible impacts.

For an API, assets can include personal data, access tokens, financial records, source code, administrative actions, and internal infrastructure.

Attack surfaces include endpoints, file uploads, query parameters, authentication flows, webhooks, integrations, GraphQL or query-like interfaces, and administrative APIs.

Think in terms of confidentiality, integrity, availability, authentication, authorization, accountability, and abuse prevention.