API Pentest
Security assessments for REST, GraphQL, SOAP and microservice APIs, focused on authentication, authorization, data exposure and business logic flaws.
| Request | Anonymous | Client A | Admin |
|---|---|---|---|
| GET/v1/invoices/48210client A's invoice | 401 | 200 | 200 |
| GET/v1/invoices/48213client B's invoice | 401 | 200 | 200 |
| PATCH/v1/users/metries to change its own role to admin | 401 | 403 | 200 |
| POST/v1/admin/refundsadministrative function | 401 | 403 | 200 |
200 where 403 was expected: client A reads client B's invoice.
Assessment coverage
APIs expose critical application functionality. Small flaws can lead to unauthorized access, abusive automation or mass data exposure.
- 01Authentication and authorization
- 02OWASP API Security Top 10
- 03Sensitive data exposure
- 04Manual business logic analysis
- 05JWT and session management
- 06Rate limiting and API abuse
- 07Headers and security configuration
- 08Executive and technical report
What you receive at the end
Documentation you can use to decide, to fix and to evidence the assessment.
- Executive report
- Risk explained in business terms, so leadership can decide and prioritize.
- Technical report with evidence
- Every finding with severity, evidence, reproduction steps and references.
- Prioritized recommendations
- Fixes ordered by risk and described in the context of your stack.
- Retest of fixes
- Validation of the applied fixes, when included in the contracted scope.
Assessment methodology
The assessment combines technical mapping, manual validation and controlled exploitation to identify real risks in your environment.
- 01
Discovery and mapping
Mapping of the API's endpoints and flows.
- 02
Authentication testing
Validation of authentication and session mechanisms.
- 03
Authorization testing
Verification of horizontal and vertical access controls.
- 04
Manual exploitation
Hands-on exploitation to validate real-world impact.
- 05
Reporting
Executive and technical report with practical recommendations.
Most common risks found in APIs
Classes of flaws the test looks for and what each can allow. Severity does not come from the category: it is set for each finding, by the impact obtained and the conditions of exploitation.
- Broken Object Level Authorization
- One account reaches other users' or companies' objects by changing an identifier in the request. The impact depends on the data reached and on how identifiers can be obtained: from a single record to the whole customer base.
- Broken Authentication
- Flaws in login, tokens and sessions, such as a JWT accepted without proper validation or a token that never expires. They may allow acting on behalf of another user; how serious that is depends on which accounts are reached and what exploitation requires.
- Sensitive Data Exposure
- Responses that return more data than the application uses, such as internal fields or personal data. The impact depends on which data shows up and to whom: from technical details to personal data covered by the LGPD.
- Missing Rate Limiting
- No limits against automation: password guessing, user enumeration or bulk data collection. It often amplifies another flaw; the effect depends on the flow involved, such as login, sign-up or data lookup.
- Business Logic Flaws
- Flows used out of order or outside the intended rules, such as payments, coupons and limits. Scanners usually miss them; the impact is measured in the business itself: amounts, approvals, stock.
- Security Misconfiguration
- Insecure CORS settings, headers, error messages and debug endpoints. On their own they tend to have less impact, but they can reveal information that makes other attacks easier.
API types
- REST APIs
- GraphQL APIs
- SOAP APIs
- gRPC
- WebSockets
- Microservices
- Internal APIs
- Public APIs
Testing scope
- Authentication
- Authorization
- JWT
- Rate limiting
- Input validation
- CORS
- Security headers
- Business logic
References
- OWASP API Security Top 10
- OWASP Testing Guide
- PTES
- NIST
- OWASP ASVS
- CWE
- OWASP Top 10
- REST Security Best Practices
Why does your API need a penetration test?
APIs expose business data and logic directly to web applications, mobile apps and partner integrations. The most serious flaws are usually authorization flaws: the request is valid, it just should not be allowed for that user, which is why automated scanners miss it.
An API pentest checks, request by request, whether authentication and authorization hold for every user role and every object, and whether the business logic withstands unintended use.
Risks the assessment helps you avoid
- Customer data leaks
- Other users' or companies' records reachable through predictable identifiers.
- Fraud and feature abuse
- Payment, coupon or limit flows executed outside the business rules.
- Compromised integrations
- Partner keys and tokens with more permissions than they need.
- Regulatory impact
- Exposure of personal data subject to LGPD obligations.
How an API pentest is priced
Effort depends mainly on the size of the API and the number of access roles:
| Size | Typical scope | Estimated timeline |
|---|---|---|
| Small API | Up to 20 endpoints, 1 to 2 roles | 3-5 days |
| Medium API | 20 to 80 endpoints, several roles | 5-10 days |
| Large API | More than 80 endpoints or multi-tenant | 10-15 days |
| GraphQL | Depends on schema, queries and mutations | Depends on scope |
Estimated timelines; each project's schedule is set in the proposal, based on scope.
Factors that influence pricing:
- Number of endpoints and operations
- Number of user roles and permissions
- Technology: REST, GraphQL, gRPC or SOAP
- Critical business flows (payments, sign-up, integrations)
- Environment available for testing (staging or production)
Why request a quote from us?
- Scope defined from the API documentation
- Testing with real accounts for each access role
- Detailed proposal with methodology and timeline
- Retest of fixes, when included in the contracted scope
A single API authorization flaw can expose every customer's data at once, and is usually fixed with a few lines of code when it is found before an attacker finds it.
Frequently asked questions
Do you test internal APIs?
Yes. We assess both public and internal APIs, including corporate environments, private integrations and microservice-based architectures.
Is API documentation required?
No. Swagger/OpenAPI speeds up the mapping phase, but we also perform manual discovery and endpoint enumeration.
Do you assess JWT authentication?
Yes. We validate signatures, expiration, claim manipulation, authentication flows and any JWT implementation flaws.
Can the testing impact production?
Testing is carried out in a controlled way to minimize operational risk. Whenever possible, we recommend using a staging environment.
How is an API pentest different from an automated scan?
Scanners find configuration issues and some injection flaws, but they do not know what each user should be allowed to access. A pentest tests authorization with real accounts, compares responses across roles and probes the business logic.
Do you test GraphQL APIs?
Yes. We assess introspection, field- and resolver-level authorization, nested queries that consume excessive resources, and mutations that change data they should not.
What is BOLA (or IDOR)?
Broken Object Level Authorization: the API returns or changes an object based only on its identifier, without checking that it belongs to the caller. It is the first category of the OWASP API Security Top 10.
Do we need to provide test accounts?
Yes, ideally at least two accounts per access role. That makes it possible to check whether one user can reach another user's data or functions.
How long does an API pentest take?
It depends on the number of endpoints, roles and critical flows. The timeline is estimated in the proposal, before you sign.
Related articles
Need to assess the security of your APIs?
Get in touch to discuss your environment, the assessment scope and the technical requirements of your project.
Sending this form neither starts any testing nor authorizes it: testing begins only after the scope is defined and authorized in writing.
- [email protected]
- Phone
- +55 (15) 99745-2589
- Chat on WhatsApp
- Hours
- Monday to Friday, 9am to 6pm
- Confidentiality
- NDA before any sensitive information