Skip to content
Security incident? Call: +48 732 059 711
API pentest

API security, tested the way attackers do it

REST, GraphQL and SOAP — tested manually against OWASP API Top 10. We find the BOLAs and broken authentication that scanners never catch.

Who is it for?

  • SaaS platforms
  • Fintech and banking
  • Mobile backends
  • B2B integrations
  • Microservices architectures
What you get

Outcomes

OWASP API Top 10 coverage

BOLA, broken authentication, broken property-level authorization, unrestricted resource consumption, mass assignment — all tested.

Business logic attacks

Race conditions, replay attacks, workflow bypass — the bugs that actually end up in bug bounties.

Authentication deep-dive

JWT flaws, OAuth misconfigurations, API key rotation, refresh token logic — the whole identity layer.

Rate limiting & DoS

We test rate limiting, account lockout logic and the economic DoS surface.

Schema-aware testing

OpenAPI / GraphQL schema ingestion means no endpoint is missed.

Free retest

One free retest within 30 days — confirms fixes and updates the report.

How we work

OWASP API Security + manual testing

  1. 01

    Scoping

    API docs, auth model, user roles, test accounts, out-of-scope endpoints — documented in Rules of Engagement.

  2. 02

    Endpoint discovery

    OpenAPI / Swagger ingestion, GraphQL introspection, parameter fuzzing — nothing slips through.

  3. 03

    Manual exploitation

    BOLA, injection, authentication bypass, business logic — manually verified with PoCs.

  4. 04

    Report & retest

    Executive + technical report in 5 business days. Free retest within 30 days.

FAQ

Frequently asked questions

Do you need our OpenAPI / GraphQL schema?
Highly recommended. Accelerates the test and ensures 100% endpoint coverage.
Can you test a GraphQL API?
Yes. We test introspection, depth/complexity limits, authorization at field level and typical GraphQL bugs.
How long does it take?
Typical REST API: 5–8 days. Complex GraphQL or microservices: 8–15 days.
Do you test staging or production?
Preferably staging. Production testing is possible with a careful Rules of Engagement window.
NIS2 / DORA evidence?
Yes. The report is accepted as evidence of technical testing under NIS2 and DORA.

Scope your API pentest

Share your API docs or schema — we will come back with a plan and price within one business day.