The defining idea is that the client is irrelevant. Hiding a button, disabling a field or validating input in the mobile app does nothing, because an attacker sends requests directly. Every control that matters must be enforced server side, per request, per object.
Authorisation testing is the bulk of the work and needs structure: a matrix of every role against every endpoint and object, tested with a second account to prove or disprove access. This is tedious, which is exactly why it is skipped and why broken object level authorisation stays the top API risk year after year.
The second theme is what an endpoint returns versus what the client renders. Serialisers that expose internal identifiers, password hashes, other users' email addresses or debug fields are common, invisible in the interface, and a straight data-protection problem the moment anyone looks.
In short
- Test with at least two accounts per role — one to act, one to be attacked.
- Undocumented and deprecated endpoints are where the worst findings hide.
- GraphQL needs depth, cost and introspection controls beyond REST rules.
- Rate limiting belongs at the gateway, not in the client.