search

OWASP / crAPI

completely ridiculous API (crAPI)
Apache License 2.0
1.11k stars 344 forks source link

Up-to-date postman collection as per all the supported vulnerabilities #113

Open JBAhire opened 2 years ago

JBAhire commented 2 years ago

Is your feature request related to a problem? Please describe. The current crAPI postman collection is 5 months old and there have been some enhancements afterward. Some of the changes might be in API specs and will need updates in API specs as well as postman collections.

Describe the solution you'd like Can we have a GitHub workflow which runs on every PR or every week, checks for a diff of postman collection, and updates the postman collection if necessary?

testingGarage commented 2 years ago

@JBAhire Assign this ticket to me.

Also please share the API specs which have the list of APIs used in the crAPI. Please do ask for the information that you need to assist me.

piyushroshan commented 2 years ago

Will need to update the api spec as well. Which doesn't contain some of the APIs. We need to automate api spec validation based on postman collection

piyushroshan commented 2 years ago

There are hidden apis that are not documented. Part of the challenge which should remain hidden IMO.

testingGarage commented 2 years ago

@piyushroshan What's the goal here? What has to be done with this collection? I see one task from @JBAhire, that is, to have a workflow that runs on every PR or every week.

What else?

Suppose, if I have to fix this collection and include other APIs, I will need the list of APIs that are not available in this collection, right? If you say, those missing APIs that are added now and not present in this collection; it has to be identified and added to this collection. Then is the challenge to pick and work you are saying? Clarify, please.

cc: @JBAhire

piyushroshan commented 2 years ago

One API that I see missing is get specific order workflow. i.e order/order-id. Others please audit the flow from UI to validate and update both the postman collection and api spec. The automation to validate the spec and postman collection are in sync can be taken as another issue.