Abstract: Aspects of the disclosure relate to assessing authorization control of application programming interfaces (APIs) for services and/or microservices. Implementations disclosed herein robustly identify APIs configured with sufficient authorization control and APIs configured with insufficient authorization control. As such, disclosed implementations streamline a secure software development life cycle. Operations performed in example implementations include obtaining an identity token from an identity management module and invoking an API with multiple queries. At least one of the queries includes payload values specific to an identity different than an identity represented by the identity token. Responses of the API to the multiple queries are used to determine whether the API is configured with sufficient authorization control, and based on the determination, various post-assessment operations can be performed.