A penetration tester has been asked to conduct a penetration test on a REST-based web service. Which of the following items is required?

Vulnerability scan results reflect findings from automated tools against known signatures and do not reveal the application-specific logic, endpoints, or authentication flows of a REST API.

REST APIs do not have a standardized discovery mechanism like WSDL used in SOAP services, so the tester must have sample requests to understand available endpoints, expected input formats, authentication headers, and data structures. Without sample requests, the tester cannot craft meaningful fuzzing payloads, test for injection flaws, or assess authorization logic. Sample requests serve as the foundational map of the API's attack surface.

A list of possible exploits is not required upfront because REST API testing is highly application-specific, and generic exploit lists do not map directly to custom API logic or business rules.

Sample test accounts may be useful for authentication testing but are not universally required and cannot substitute for understanding the API request structure itself.