API Penetration Testing
API penetration testing for REST and GraphQL across Europe: BOLA, auth, tokens and SSRF tested by hand. Fixed price, free retest. Get a quote.
API penetration testing finds the flaws in the endpoints behind your app, where authorization, tokens and object references are enforced or quietly are not. We test your REST and GraphQL APIs by hand across Europe and prove exactly what an attacker with a valid token, or none at all, can reach, and how far that access spreads.
APIs carry the traffic that used to live inside a monolith, and they expose far more than a user interface ever did. A web page shows a customer their own orders. The API behind it will happily return order number 4,051 if you ask for it and nobody checked whether that order is yours. This is the defining risk of modern applications, and it is why APIs deserve their own dedicated test rather than a glance during a general web pentest.
What API penetration testing covers
We test the API as its own attack surface, structured around the OWASP API Security Top 10, which is a different list from the web Top 10 for a reason: the risks that dominate APIs are authorization and object-level access, not the injection and XSS that dominate rendered pages. Coverage spans both your documented endpoints and the ones we discover that were never meant to be public.
REST and GraphQL, tested properly
The two dominant API styles fail in different ways, and testing them the same way misses things. We test both, and if your product exposes both we cover both in one engagement.
REST APIs
With REST the risk concentrates in the object references and the HTTP methods. We walk every endpoint with valid credentials for each role, then try to read and modify objects that belong to other users by changing identifiers, and we test whether a GET-only role can reach a DELETE or PUT it should not. We also check for mass assignment, where sending an extra field like role or is_admin in an update quietly grants privileges the API never meant to expose.
GraphQL APIs
GraphQL concentrates power in a single endpoint, which brings its own problems. We check whether introspection is left open and leaking your whole schema, whether a single deeply nested or aliased query can exhaust the server, and whether authorization is enforced consistently across every resolver rather than only on the obvious ones. A GraphQL API often enforces access on one query and forgets it on the mutation that changes the same data.
The OWASP API Security Top 10 in practice
The list is a useful spine, and API security testing best practices start with covering it properly. A few categories deserve calling out because they cause most of the real damage.
Broken object level authorization
The single most exploited API flaw. An endpoint returns or edits an object based on an identifier the caller supplies, without checking that the caller owns it. We test this on every object-bearing endpoint, because one missed check can expose every record in the database one identifier at a time.
Broken authentication and token handling
We examine how tokens are issued, validated and revoked. Common findings include JWTs that accept a weak or absent signature, access tokens that never expire, refresh flows that can be replayed, and OAuth scopes that are granted but never enforced. These turn a single leaked token into lasting access.
Broken function level authorization
Administrative functions exposed on predictable paths, or actions that check the user’s role in the interface but not in the API. We enumerate functions and test each one as a lower-privilege user to see what the server actually allows rather than what the front end hides.
Unrestricted resource consumption
APIs without rate limiting or pagination limits can be driven into denial of service or used to brute-force codes and enumerate data cheaply. We test whether an attacker can make the API do far more work than it should for a single request or a burst of them.
How we test
Every API penetration testing engagement is run manually by a certified offensive engineer (OSCP, OSWE). Burp Suite is the working proxy for intercepting and manipulating requests, and we use your API documentation, an OpenAPI or GraphQL schema where you have one, and traffic capture to build a complete inventory before testing.
Inventory and reconnaissance
You cannot test an endpoint you do not know exists. We build the full picture: documented endpoints, undocumented ones found through the app’s own traffic, old API versions still live, and staging endpoints left exposed. Improper inventory management is its own Top 10 category because forgotten endpoints are where the weak old code lingers.
Authenticated, multi-role testing
We test with valid credentials for each role your API supports, then systematically try to cross those boundaries. This is where object-level and function-level authorization flaws surface, and it is the part a scanner cannot do because it has no concept of who should be allowed to do what.
Reporting and retest
You get an executive summary and a technical report where every finding carries a CVSS score, its API Security Top 10 category, exact reproduction with the raw requests, and a specific fix. After you remediate, the retest is included so you can confirm the endpoints are locked down.
Want this tested on your own systems?
Free 20-minute scoping call, a fixed price with no hourly surprises, and a free retest once you fix what we find.
Compliance and standards
APIs handle the same regulated data as the rest of your app, so the same obligations apply, and the report is written to prove coverage.
PCI DSS, ISO 27001 and SOC 2
Where an API touches cardholder data, PCI DSS 4.0 requirement 11.4 covers it, and our reporting is built to satisfy it. For ISO 27001 the results support control A.8.29; SOC 2 auditors treat independent API testing as evidence under the security criteria.
GDPR and DORA
APIs are the most common route by which personal data leaks, so testing them supports the technical measures GDPR expects. Financial-sector organisations across Europe include API testing in their DORA threat-led testing programmes, since APIs are where the sensitive transactions actually flow and where a single unauthenticated endpoint can undermine controls applied everywhere else.
Business-flow abuse: the risk documentation misses
Some of the most costly API problems are not vulnerabilities in the usual sense. Every request is well-formed, authenticated and authorised, and yet the attacker still wins because they use a legitimate flow in a way it was never designed for. Think of an endpoint that lets a user reserve inventory, apply a promotion, or trigger a payout. On its own each call is fine. Called ten thousand times by a script, or in an order the designers never anticipated, it drains stock, exhausts a discount budget, or moves money.
How we test for it
We look at what your API is actually for and where value or state changes hands, then we probe the flows an attacker would monetise: replaying a one-time action, racing two requests to double-spend a balance, and automating a flow that assumes a human is on the other end. These are the findings that never appear in an OpenAPI spec and never show up in a scan, and they are frequently the ones that cost the most when exploited.
When to test your API
An API changes more often than the interface in front of it, and every new endpoint is a new chance for a missing authorization check. Test before a public launch, after adding a significant set of endpoints, when you expose the API to third-party developers, and on a regular cadence for anything handling payments or personal data. Teams building open-banking or partner integrations across Europe usually test at least annually, because a single BOLA flaw on a shared API can expose every partner’s data at once.
Why manual testing beats a scanner
API scanners are improving, but the flaws that matter most in APIs are precisely the ones automation handles worst. A scanner cannot know that object 4,051 belongs to a different tenant, because it has no model of ownership. It cannot tell that a mutation skips the authorization its sibling query enforces. It cannot reason about a business flow that lets an attacker drain value through legitimate-looking calls. These require a tester who understands what the API is for. That is what API security testing services should deliver, and it is what a signature-based scan never will. We still run automated checks to widen coverage and catch known-vulnerable components, but they inform the test rather than becoming the report.
Pricing
Pricing depends on the number of endpoints, whether the API is REST, GraphQL or both, how many roles it supports, and how deep you want the test to go. Here is the shape of a typical European engagement.
| Engagement | What’s included | Timeline | Price |
|---|---|---|---|
| Focused API test | Single REST or GraphQL API, one or two roles, OWASP API Top 10 coverage, report and free retest | 3–5 working days | from €2,500 |
| Standard | Business API with multiple roles, both REST and GraphQL, token and business-flow testing, exec and technical reports | 5–8 working days | €3,500–€8,000 |
| Advanced | Large or high-risk API surface, complex OAuth and multi-tenant isolation, attack-chaining across services | 8–12 working days | €8,000–€20,000 |
| Compliance add-on | API Top 10 mapping plus an attestation letter for PCI DSS, ISO 27001, SOC 2, GDPR or DORA | with any tier | from €800 |
| Custom / large estate | Many APIs or a full microservice environment, scoped to your needs | on scoping | custom |
Every engagement is fixed-price, quoted after a free 20-minute scoping call, so there are no hourly surprises and a retest is always included. Get a fixed quote
FAQ
How much does API penetration testing cost?
Do you test both REST and GraphQL APIs?
How long does the test take?
Do you need our API documentation?
What do I get at the end?
Does this satisfy PCI DSS or ISO 27001?
Will testing affect our production API or its consumers?
Are the findings kept confidential?
Related services
Any team shipping an API that customers or partners depend on: SaaS and platform businesses, fintech and open-banking providers, mobile app back ends, and companies whose product is the API itself and whose reputation rides on it staying watertight.
Security you can prove
The same standard on every engagement, big or small.
Evidence, not opinions
Every finding ships with a reproduction and proof of concept — no vague "maybe vulnerable".
Humans over scanners
Certified engineers find the logic flaws and chained attacks automated tools walk straight past.
Fixed price, free retest
You know the cost up front, and verifying the fix is part of the deal — not a second invoice.
Ready to lock this down?
Free scoping call, fixed price, free retest. Tell us what you're running and we'll take it from there — usually within one business day.
Tell us what you're running
Scoping is free. We reply within one business day, and under 30 minutes for active incidents.