API penetration testing
The endpoints your apps and partners rely on, tested for broken authorisation, data exposure and abuse.
When you need it
- Your API is used by mobile apps or partners
- You are launching a public or partner API
- Fintech, health or other sensitive data flows through it
- A customer asks for API test evidence
What we test
APIs often expose more than the interface on top of them. We test every endpoint directly, as each kind of caller, guided by the OWASP API Security Top 10.
Whether changing an ID or calling an admin function returns data or actions you should not have.
API keys, OAuth flows, JWT handling, token expiry and revocation.
Responses that return more than the client needs, including personal or internal data.
Rate limiting, resource exhaustion, mass assignment and injection.
How the test runs
- Scoping. Number of endpoints, documentation (OpenAPI, Postman or GraphQL schema) and test credentials per role.
- Testing. Usually three to six days, depending on endpoints and roles.
- Critical findings. Reported to you immediately.
- Report and debrief. Findings with example requests and fixes, a walkthrough, and one retest within 90 days.
Supports
- SOC 2
- ISO 27001
- PCI DSS
- Partner due diligence
Questions
We have no API documentation. Is that a problem?
No, but it makes testing slower. We can map the API from your app's traffic; documentation simply lets us cover more in the time.
Do you test GraphQL?
Yes, including introspection, query depth and cost limits, and authorisation on every resolver.
Should we test the API with the web or mobile app?
Often yes. Our Launch Ready bundle covers web, API and mobile in one scope and one report.
Know exactly what your test will cost by tomorrow
Tell us what you need tested. You'll get questions or a fixed quote within three working days.