API Penetration Testing.
API penetration testing is a manual security assessment of your REST and GraphQL APIs — focused on authorization, object-level access control (BOLA/IDOR), authentication, and injection — to find and prove the flaws that automated scanners miss in the services powering your apps.
Depending on agreed scope, testing may cover documented or discovered endpoints with reference to the OWASP API Security Top 10. The written scope defines endpoint inventory and coverage.
Broken object-level auth (BOLA/IDOR)
The number-one API risk — accessing other users’ or tenants’ objects by manipulating identifiers.
Broken authentication
Weak tokens, JWT flaws, missing rate limits on auth, and credential-stuffing exposure.
Function & property-level auth
Privilege escalation via hidden methods, and mass assignment that lets clients set fields they should not.
Injection & SSRF
SQL/NoSQL injection, command injection, and server-side request forgery through API parameters.
GraphQL-specific
Introspection abuse, batching attacks, deeply nested queries, and field-level authorization gaps.
Rate limiting & resource use
Unrestricted resource consumption and business-flow abuse that enables denial-of-wallet or fraud.
- An executive summary that ties API risk to real business impact.
- Each finding with reproduction steps, evidence, and CVSS-scored severity.
- Developer-ready remediation for each endpoint and class of issue.
- A retest may be defined in a written engagement scope.
API testing references the OWASP API Security Top 10. The written engagement scope controls the applicable coverage and reporting format.
Do you test both REST and GraphQL APIs?
Yes. We test REST, GraphQL, and SOAP APIs. GraphQL gets specific attention for introspection, batching, and nested-query abuse on top of the standard authorization and injection checks.
Do you need API documentation?
It helps but is not required. We work from an OpenAPI/Swagger spec, a Postman collection, or captured traffic. If none exists, we can discover endpoints as part of the engagement.
Is API testing not already covered by a web pentest?
A web pentest covers the APIs behind that specific app. A dedicated API pentest is the right choice when the API is a standalone product, serves mobile or third-party clients, or has many endpoints that warrant focused authorization testing.
How much does an API pentest cost?
It scales with the number of endpoints and roles in scope. Commercial terms are agreed in a written engagement scope.