API

API security testing

Endpoint discovery and vulnerability testing of one API, with request-level evidence for every finding. From $550 per scan.

APIs fail differently from web pages: broken object-level authorisation, over-permissive responses and missing rate limits rarely show in a browser. API testing works from your specification and checks every endpoint against what it should and should not allow.

Method

  1. Scope: base URL, specification, test accounts and ownership confirmed.
  2. Endpoint discovery and authentication mapping.
  3. Automated and manual testing per endpoint.
  4. Report and consultation, then a retest of fixed items.

Included at the starting price

  • Endpoint discovery from the specification you provide (OpenAPI or Postman) or from traffic
  • Authentication, authorisation and object-level access checks
  • Injection, mass assignment, rate limiting and data exposure checks
  • Request-level evidence for every finding

Not included

  • Third-party APIs you do not own
  • Load or performance testing

Deliverable

Technical report (PDF) with reproduction requests per finding, an executive summary and a results consultation call.

Questions

Do you need API documentation?

An OpenAPI file or Postman collection gives the best coverage. Without one, discovery is done from traffic and the report states the limits.

Request an assessment

Tell us what you need tested.

We reply within one business day with a scoped proposal. No scan runs until ownership of the target is confirmed.

  • Web, app and API testing
  • Code analysis and server scans
  • Ongoing patch management
  • Post-quantum readiness review

Enter your name.

Enter a valid email address.

Hostnames can wait for the scoping call.

Request sent. We'll reply within one business day with a scoped proposal.