Back to API Practice

Security/Auth trainer

Tenant Isolation API Practice

Practice tenant-scoped reads and writes, IDOR, trusted tenant claims, cross-tenant denial, cache leakage, exports, and audit events.

Start writing test ideasTry API sandbox

How to use this trainer

Choose, send, inspect, write, improve

Safe client-side simulator. No real backend is called and no real data is sent.

  1. 1Choose a preset case
  2. 2Send a simulated request
  3. 3Read the response and QA note
  4. 4Write what you would test
  5. 5Check your coverage

Interactive sandbox

Try the API request

Pick a preset, send a simulated GET /api/tenants/{tenantId}/resources/{resourceId} request, inspect the fake response, and turn it into test ideas.

Tenant IDs and resource IDs are fake local examples only.

Request

Build the request

GET/api/tenants/{tenantId}/resources/{resourceId}

Request JSON

application/json
{
  "tenantId": "tenant_current",
  "resourceId": "res_123",
  "operation": "read"
}

Test case presets

Choose a case, inspect the fake response, then write what you would test.

Happy path

Cross-tenant

Claims / inputs

Collection surfaces

Data leakage

Reliability

Response

Fake API result

Send a simulated request to see status, response JSON, QA note, and what to notice. No real backend is called.

List own-tenant access, cross-tenant read/write denial, tenant claim tampering, IDOR, protected tenantId, list/search/export scoping, safe 403/404, audit logs, and outages.

Tip: a stronger answer usually mixes happy path, negative cases, state changes, data, backend, UX, accessibility, and risk.

How to structure your answer

Happy pathNegative casesData rulesSecurity/API risksUX/performance
API ReferenceEndpoint, request fields, responses, and business rulesExpand

API reference

Tenant Isolation endpoint

Return tenant-scoped resources while enforcing trusted tenant context and blocking cross-tenant access.

Endpoint

GET/api/tenants/{tenantId}/resources/{resourceId}

Purpose

Return tenant-scoped resources while enforcing trusted tenant context and blocking cross-tenant access.

Request fields

  • tenantId: path or trusted auth claim
  • resourceId: path param
  • operation: read, update, delete, list, export
  • body.tenantId: protected if present

Success response

200 OK

Request body

{
  "tenantId": "tenant_current",
  "resourceId": "res_123"
}

Example response body

{
  "id": "res_123",
  "tenantId": "tenant_current",
  "name": "Current tenant report"
}

Errors

  • 400 malformed tenant or resource ID
  • 401 unauthorized
  • 403 forbidden tenant
  • 404 safe not found
  • 503 auth/database unavailable

Security notes

  • Client tenantId must not override auth claims
  • Object IDs are authorization scoped
  • Cache keys include tenant
  • Denied errors avoid existence leaks

Business rules

  • Own-tenant reads succeed
  • Cross-tenant reads and writes are denied
  • Lists/search/exports filter by tenant
  • Background jobs preserve tenant context
  • Audit logs include actor and target tenant