Analyzing auth coverage

Authentication Coverage Analysis

What this skill uses

Traceable MCP tools: traceable-ai:execute_graphql_query, traceable-ai:get_attribute_mappings, traceable-ai:get_display_urls, traceable-ai:get_graphql_query_template_details, traceable-ai:get_query_time_range, traceable-ai:get_threat_activity_timerange, traceable-ai:get_vuln_enum_filter_supported_values

Instructions

See references/query-guide.md for the standard MCP tool calling sequence and syntax rules.

Prerequisites

• Before any vulnerabilitiesV3 query call traceable-ai:get_vuln_enum_filter_supported_values to fetch valid enum values for severity, status, category, etc. Filter values from prior conversations may be stale.

Domain Context

Authentication in Traceable's Model

Traceable observes authentication at the traffic level and classifies each API endpoint:

• isAuthenticated (BOOLEAN): Whether the API requires authentication based on observed traffic. false means Traceable observed successful requests without any auth token/credential.
• authTypes (STRING_ARRAY): Authentication mechanisms observed (Bearer tokens, API keys, Basic auth, OAuth, JWT). An API can use multiple auth types.
• isExternal (BOOLEAN): Whether the API is reachable from outside the organization. External + unauthenticated is the highest-risk combination.
• hasPii (BOOLEAN): Whether the API handles PII/sensitive data. PII + unauthenticated means sensitive data is accessible without credentials.
• isShadow (BOOLEAN): Whether the API is undocumented. Shadow + unauthenticated is the maximum blind spot.

Why This Matters

A 22% unauthenticated rate is a significant attack surface. The intersection of unauthenticated + external + PII-handling APIs represents the most critical security gap: an attacker from the internet can access sensitive data without providing any credentials.

Step-by-Step Workflow

For the full step-by-step GraphQL queries and detailed workflow, see references/workflow-detail.md. Summary:

1. Initialize time range (traceable-ai:get_query_time_range)
2. Discover attributes (traceable-ai:get_attribute_mappings for each scope)
3. Get query template (traceable-ai:get_graphql_query_template_details)
4. Execute the query (traceable-ai:execute_graphql_query)
5. Generate UI deep links (traceable-ai:get_display_urls)

Prioritization Framework

Tier 1: CRITICAL (Remediate Immediately) All true: isAuthenticated = false, isExternal = true, hasPii = true. Escalation factors: open auth vulns, active threats, shadow status, high actor count. Action: Add authentication immediately. If not possible, implement rate limiting and IP blocking.

Tier 2: HIGH (Remediate Within Sprint) Any of: external + unauthenticated (without PII), unauthenticated + PII (without external), unauthenticated with auth-category vulnerabilities. Action: Schedule auth addition. Review if API genuinely needs to be unauthenticated.

Tier 3: MEDIUM (Plan Remediation) Internal-only, unauthenticated, no PII. Or unauthenticated but encrypted and low traffic. Action: Evaluate whether auth is appropriate. Document exceptions for health checks.

Tier 4: ACCEPTED RISK (Document and Monitor) Health check/readiness/liveness endpoints, public documentation, CORS preflight handlers, confirmed intentionally public endpoints. Action: Document business justification. Monitor for traffic pattern changes.

Examples

Output Format

Executive Summary:

Authentication Coverage: X/Y APIs authenticated (Z%)
Unauthenticated APIs: N
  - External + Unauthenticated: N1 (CRITICAL)
  - PII + Unauthenticated: N2
  - External + PII + Unauthenticated: N3 (HIGHEST RISK)
  - Shadow + Unauthenticated: N4
Auth-Related Vulnerabilities: N5 open (authentication: A, authorization: B, access_control: C)
Active Threats on Unauth APIs: N6

Tier 1 Critical Findings Table:

API Name	Service	Domain	PII Types	Risk Score	Vulns	Threat Activity	Recommendation

Auth Type Distribution:

Auth Type	API Count	%	External APIs	Notes

Vulnerability Analysis:

Vuln Title	Severity	API	Category	OWASP	External?	Mitigation

JWT Assessment:

Finding	Severity	Affected APIs	Risk	Recommendation

Example Narrative

Authentication Coverage Analysis

Of 991 total APIs, 221 (22.3%) lack authentication. This exceeds the recommended threshold of 15%.

Critical Findings: [N] APIs are externally reachable, handle PII, and require no authentication.

Vulnerability Correlation: [N] open authentication/authorization vulnerabilities exist, with [N] at CRITICAL/HIGH severity.

Active Exploitation: [N] active threats target unauthenticated APIs, with [N] currently unblocked.

Related skills

Prerequisites (skills typically run before this one):

• /inventorying-apis

Composes with (skills commonly invoked together):

• /analyzing-pii-exposure
• /assessing-risk

Follow-ups (skills commonly chained after this one):

• /reporting-compliance
• /engineering-deep-dive
• /remediating-vulnerabilities

Performance Notes

• With 221 unauthenticated APIs, a single query with limit: 50 returns only 23%. Always paginate.
• Production unauthenticated APIs are far more critical than staging/dev. Filter by environment if needed.
• Always call traceable-ai:get_threat_activity_timerange before threat queries.

Cross-References

• assessing-risk: How authentication gaps contribute to API risk scores.
• analyzing-pii-exposure: Specific sensitive data types flowing through unauthenticated APIs.
• discovering-shadow-apis: The shadow + unauthenticated intersection (maximum blind spot).
• investigating-threats: Deeper investigation into threat actors targeting unauthenticated APIs.
• prioritizing-findings: Triage auth-related vulnerabilities with severity-based prioritization.

Troubleshooting

1. isAuthenticated is observational, not prescriptive. Traceable marks an API as unauthenticated because it observed successful requests without auth tokens. This could mean auth bypass, optional auth, or inconsistent enforcement.

2. authTypes can be empty even on authenticated APIs. If Traceable has not classified the mechanism yet. Do not confuse "auth type unknown" with "no auth."

3. attribute() returns string representations. isAuthenticated returns "true" or "false", not booleans. authTypes returns a JSON-encoded array string.

4. VulnerabilityV3 filters use nested structure. Use filter: { relationalFilter: {...} } or filter: { logicalFilter: {...} }.

5. VulnerabilityV3 value in filters is always a string. For IN: value: "[\"authentication\",\"authorization\"]".

6. VULNERABILITY_TITLE LIKE filter is case-sensitive. Match exact case (typically UPPER_SNAKE_CASE).

7. ThreatActivity can timeout on large datasets. Always apply filters.

8. Risk scores may be null or 0. An unauthenticated API with no risk score is still a risk.

9. Health check endpoints are often intentionally unauthenticated. Patterns: /health, /healthz, /ready, /readiness, /live, /liveness, /ping, /status. Flag but do not automatically classify as a gap.

10. Shadow + unauthenticated is the blind spot. Always highlight these: they exist, accept traffic, have no documentation, and require no auth.

11. Pagination is critical. With 221 unauthenticated APIs, always check total and paginate.