---
name: api-graphql-trust-analysis
description: Map authorized REST, GraphQL, and typed API operations, object boundaries, field exposure, and server-side trust assumptions.
---

# API and GraphQL trust analysis

## Accepted inputs

- Current scope, controlled identities, and read or mutation limits
- API descriptions, schemas, proxy history, client operations, and error samples
- Owned objects for safe validation

## Procedure

1. Inventory base paths, transports, operation names, methods, arguments, object types, fields, and observed identities.
2. Separate documentation, introspection, client-declared operations, and server-observed behavior by provenance.
3. Build an identity-object-operation matrix for read, create, update, delete, batch, export, and subscription paths.
4. Rank authorization, mass-assignment, overfetching, alias or batch cost, and unsafe downstream-consumption leads.
5. Test one field, object, identity, or operation change against an owned baseline.
6. Use an unknown field, nonexistent object, or denied role as the appropriate negative control.

## Output artifacts

- Operation and schema inventory
- Authorization and field trust matrix
- Cost-control observations and bounded next tests

## Stop conditions

No broad enumeration, high-cost query, uncontrolled mutation, or schema action prohibited by policy.

## Completion gate

Complete when high-ranked operations have provenance and an owner, supported gaps repeat safely, and unsupported assumptions are removed.