01
Who can access your data and operations?
Assess identities, tokens and permissions across users, roles and organisations, including access to sensitive records and administrative functions.
API penetration testing
Know how well your APIs
protect customer data.
APIs connect your product to users, partners and other systems. We assess the agreed endpoints and permissions so your team can see where access controls and sensitive operations need attention.
Private, self-hosted AI assistance. Assessment material is not sent to third-party model providers for that assistance.
Questions your test can answer
Test the controls.
Understand the implications.
The OWASP API Security Top 10 and relevant OWASP ASVS requirements form our baseline. We build on them with specialist testing tailored to your API’s design, business logic and integrations.
02
How safely does your API process requests?
Examine input handling and validation for injection and related weaknesses that could expose information or change how your API behaves.
03
Could API features be used in unintended ways?
Assess the business rules behind sensitive operations and connected actions, including gaps that could allow processes or transactions to be misused.
04
Could responses or integrations expose your data?
Review the information your API returns and how it handles data from connected services, including excessive disclosure and misplaced trust in external responses.
05
Could API usage create avoidable costs or disruption?
Assess controls around repeated requests, automated use and costly operations that could create avoidable charges or disrupt service.
06
Are your API configuration and endpoints secure?
Review API gateways, exposed versions and unnecessary endpoints, with checks tailored to REST, GraphQL and the protocols in scope.
Your assessment output
Evidence for your team.
Clarity for your reviewer.
Your report includes an executive summary, a summary of findings and detailed findings with descriptions, reproduction steps, remediation steps and references. A readout helps your team understand the priorities and next steps.
Your assessment report
Clear findings.
A useful next step.
Executive summary
Key findings & implications
Summary of findings
An overview of the issues
Finding details
Understand, reproduce & remediate
Each detailed finding includes a description, reproduction steps, remediation steps and references.
Getting started
Bring the context.
We’ll shape the scope.
Bring API documentation, representative roles, test credentials through the agreed secure channel, and a list of integrations that are in scope.
Let’s talk through
your penetration test.
Tell us about your product, your deadline and the evidence your reviewer needs. We’ll agree the scope and handling arrangements before work starts.