API pentest
REST, GraphQL and gRPC endpoints tested against the OWASP API Security Top 10, using your specs and real tokens for each role.
- Typical length
- 4–8 testing days
- Approach
- Grey box with API docs
- Price
- From $3,500
What we test
- Object- and function-level authorization
- Mass assignment
- Rate limiting and resource exhaustion
- GraphQL introspection and batching abuse
- JWT and OAuth misconfiguration
Standards we follow
- OWASP API Security Top 10 (2023)
- OWASP WSTG
- OWASP ASVS 4.0
- CVSS 3.1 scoring
Issues we often find
Typical findings from this kind of test, written the way they appear in our reports.
- A user can read or change objects owned by another tenant
- Extra fields in a request change the user's role
- Unlimited login attempts allow password guessing
- Tokens never expire or are accepted after logout
What we need from you
We send this checklist at kickoff so testing starts on day one.
- OpenAPI/Swagger, GraphQL schema or a Postman collection
- API keys or tokens for each role
- Base URL of the environment to test
- Rate limits we should respect
How the engagement runs
Scope
We agree on targets, test accounts, rules of engagement and testing windows. You get a fixed quote.
Recon
We map your attack surface: hosts, routes, roles, third-party services and data flows.
Exploit
Testers chain weaknesses the way a real attacker would and confirm impact without harming production.
Report
Findings are rated with CVSS 3.1, with proof, business impact and a clear fix for each one.
Retest
Once you have fixed an issue, we verify it and update its status in the report.
Attest
We issue a signed letter of attestation you can share with customers and auditors.
Essential pentest: $3,500
One application or API, up to 5 testing days, a retest and a signed letter of attestation. No extras.