> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/pentests/preparing-for-an-engagement.md).

# Preparing for an Engagement

One application is one target URL. Each service behind it, including downstream services, is a separate web service.

## Checklist

|   | Item                                             | Required             |
| - | ------------------------------------------------ | -------------------- |
| 1 | Target base URL, including the API path prefix   | Yes                  |
| 2 | API specification served by the test environment | Strongly recommended |
| 3 | Test identities                                  | Strongly recommended |
| 4 | Test records for those identities                | Strongly recommended |
| 5 | Nullify source IPs allowlisted                   | Yes                  |
| 6 | Rate limits relaxed for those IPs                | Recommended          |
| 7 | Repository and path per service                  | Recommended          |
| 8 | Authorization and test window                    | Yes                  |

## 1. Target

The full base URL of the API, including any path prefix: `https://api.staging.example.com/api/v2`, not `https://api.staging.example.com`. For GraphQL, the endpoint URL. In the dashboard the target takes the host, port and protocol; give the path prefix to your Nullify contact.

Use a disposable staging or QA environment. The pentester sends real attack traffic and may create, modify, or delete data.

If the service is not reachable from the internet, see [Running in Private Networks](/capabilities/pentests/private-networks.md).

## 2. API specification

Serve the specification from the test environment under the base URL at one of `/openapi.json`, `/openapi.yaml`, `/swagger.json`, `/swagger.yaml`, `/api-docs`, `/v3/api-docs`, `/api/openapi.json`, `/docs/openapi.json`, or enable GraphQL introspection. On a CLI run you can also pass a file with `--spec-path`.

OpenAPI 3.x or Swagger 2.0, JSON or YAML.

## 3. Identities

Provide:

* One identity per role or permission level in the application, with a sentence on what it may and may not do in the credential's description
* For a role that owns records, two identities with distinct credential names and separate records
* For a multi-tenant application, an identity in a second tenant

Two authenticated identities is the minimum for cross-identity authorization testing.

For each identity:

* Username and password, and the login URL for form logins

Use dedicated test accounts valid for the whole engagement window, with multi-factor authentication off.

Configure username and password or HTTP basic authentication in the dashboard. Give API-key, bearer-token, OpenID Connect and OAuth 2.0 settings, a non-standard login form, or a required second factor to your Nullify contact before the engagement.

Validate each credential in the dashboard before the engagement. Review any result that is not successful with Nullify before starting.

## 4. Records

Each identity needs records of the kinds the API serves, so that access can be compared across identities. Unlock any account state that endpoints depend on, such as verified contact details or completed onboarding.

## 5. Source IPs

Ask your Nullify contact for the addresses to allowlist, and allowlist them by IP address on any WAF, API gateway, or secure web gateway in front of the target, and in security groups.

If out-of-band checks are in scope, also allow the outbound callback domains your Nullify contact gives you.

## 6. Rate limits

Relax or exempt rate limits and bot mitigation for the Nullify source IPs during the test window.

## 7. Repositories

Give your Nullify contact the repository and repository path for each service behind the target, including downstream services, and which test credentials belong to each.

## 8. Authorization and test window

Agree with your Nullify contact before the run:

* Written authorization covering the permitted targets and actions; give any exclusions to your Nullify contact before the run
* Start and end of the test window, with timezone
* A named contact on your side for the duration of the run

A run can be stopped at any time from the dashboard.

## Preflight

If prompted, select **Run readiness check** before starting.