Various embodiments facilitate Application Programming Interface (APIs) testing. In some examples, an apparatus detects security vulnerabilities in an API. The apparatus comprises one or more computer-readable storage media, a processing system operatively coupled with the one or more computer-readable storage media, and program instructions stored on the one or more computer-readable storage media. When executed by the processing system, the program instructions direct the processing system to perform operations. The apparatus monitors API traffic and responsively generates contextual information that characterizes the operations of the API. The apparatus generates an API test based on the contextual information to detect the security vulnerabilities in the API. The apparatus executes the API test on the API. The apparatus generates test results that indicate detected security vulnerabilities in the API. The processing system exports the test results.