What we test
API Penetration Testing
Testing the API as the primary attack surface rather than as plumbing behind a user interface, including the endpoints the interface never calls.
Who asks for this
Companies whose product is an API, and companies whose web application is a thin client over one. The second group underestimates this: an API tested only through the interface is only partly tested.
What the test covers
- Endpoints reachable without going through the interface, including deprecated and undocumented versions
- Object-level and function-level authorization on every method, not just the ones the client uses
- Token handling: scope, expiry, revocation, refresh, and what a leaked key can reach
- Mass assignment and over-permissive request binding
- GraphQL specifics: introspection exposure, query depth and cost, batching abuse
- Rate limiting and resource exhaustion on the operations that cost the most to serve
What this test typically finds
Classes of finding, not a severity table. These are the issues that recur on this surface.
Broken object-level authorization
The API equivalent of cross-tenant access, and consistently the highest-impact API finding. An object ID is accepted without checking that the caller owns it.
Endpoints the interface has outgrown
A previous API version still live and still routing, usually without the authorization checks the current version gained.
Tokens with more reach than intended
An API key scoped to read that can write, or a token that survives a revoked user's removal.
Mass assignment
A request body that sets fields the client should never control, such as a role or an account identifier.
Questions people ask
Do you need API documentation to test an API?
It helps and it is not required. A specification makes coverage provable, which matters for an audit artifact. Without one, testing starts from observed traffic and discovery, and the report notes what coverage was established.
Can you test a GraphQL API?
Yes. GraphQL shifts the risk rather than removing it: introspection exposure, query depth and cost abuse, and authorization applied at the resolver level are the recurring issues, along with the same object-level authorization problems REST APIs have.
Related surfaces
Get a scoped price without a discovery call
Tell us what is in scope and what your audit needs. You get a fixed price and a date, not a quote after two meetings.