Automated REST API testing has traditionally focused on functional compliance, leaving security assurance comparatively underexplored; existing tools operate at the syntactic level and cannot reliably detect the semantic vulnerabilities behind several top-ranked OWASP API Security categories. This work proposes a contract-driven approach that derives all target knowledge from the OpenAPI specification and a configuration file, embedding evaluation criteria directly into deterministic test oracles and organizing checks into an eight-domain taxonomy scaling with available privileges. Tested on a realistic setup, the approach correctly classified expected outcomes, revealed a real discrepancy between declared and actual API behavior, and produced reproducible results, contributing a systematic approach to the oracle problem and a process ready for integration into automated pipelines.