Check who can do what

The most damaging API bugs are often about permissions: a normal user who can open an admin page, or someone signed out who can read private data. Swastik Codes lets you test this on purpose, as part of your normal testing.

Set up roles

1. Open your collection and go to the Roles tab.
2. Click Add Admin, User and Guest. Swastik Codes looks for your sign-in request and connects each role to it.
3. Give each role its own values, for example its email and password (type passwords as the current value, so they stay on your device, or use {{vault:…}}). The Guest role sends requests without any authorization.

Send as a role

Use Run as beside the environment menu at the top right and pick a role. Every request in the collection is now sent as that user. Swastik Codes signs in for the role when needed, keeps its token on your device, and signs in again when the token expires or the API answers 401.

That alone makes manual checks quick: open an admin request, switch to User, send, and expect a 403.

Check everything at once with the access matrix

At the bottom of the Roles tab is the Access matrix: one row per request, one column per role.

1. Click a cell to say whether that role should be allowed (✓) or denied (✕), or leave it blank to skip it. The all ✓ and all ✕ links under a role's name fill a whole column.
2. Click Check access. Every request is sent once as every role in the current environment.
3. Read the result. Each cell shows the status code it got:
   • green: as expected;
   • red with a border: allowed when it should have been denied. Fix these first;
   • yellow: denied when it should have been allowed;
   • grey outline: an answer that says neither (such as 400 or 500).

Allowed means a 2xx or 3xx answer; denied means 401, 403 or 404. Your expectations are saved with the collection, so the whole team checks against the same matrix. Report downloads the mismatches as text.

What you learned

• Roles let you send any request as an admin, a user or a guest, with sign-in handled for you.
• The access matrix checks every role against every endpoint and highlights access that should be denied.

Next: check your API for security problems and invalid input.

Go deeper

• FeatureEnvironments and variables
• FeatureAuthorization
• LessonCollections, folders and authorization