API Penetration Testing
Built fast, tested never.
Let's change that.
Assure your REST, GraphQL, and SOAP APIs against data exposure and unauthorised access. CREST-accredited, OWASP API Top 10 aligned testing.
- CREST-accredited
- Consultant-led testing
- Transparent pricing
Who Needs This
Who needs API penetration testing?
APIs are the backbone of modern applications, but they are also one of the most common sources of data breaches. Any organisation that exposes or consumes APIs should have them tested regularly.
API-first companies and microservices
API-first architectures surface every function directly through exposed endpoints. Missing authentication, broken object-level authorisation, and mass assignment are common findings.
Mobile app backends
Mobile applications communicate with backend APIs that are often less well-tested than their web counterparts. Rate limiting, authentication weaknesses, and data exposure are common.
Public API services
APIs consumed by third-party developers or partners require rigorous testing. Security issues in public APIs affect all consumers and can be discovered and exploited by anyone with API access.
Internal APIs and integrations
Internal APIs between services often lack the same security controls applied to external-facing endpoints. Broken function-level authorisation and insufficient validation are frequent findings.
Our Pentest Methodology
OWASP API Top 10 aligned testing
Our API testing methodology is aligned with the OWASP API Security Top 10. We combine automated discovery with manual exploitation to find what scanners miss, including business logic abuse and issues that only become serious once chained together.
01
Broken Object Level Authorisation
Testing whether API endpoints enforce object-level access controls, allowing users to access or manipulate resources belonging to other users by modifying object references.
02
Broken Authentication
Assessment of token generation and handling, session management, credential policies, and whether authentication mechanisms can be bypassed or abused.
03
Broken Function Level Authorisation
Identifying whether administrative or privileged API functions are accessible to lower-privileged users by manipulating HTTP methods, endpoints, or request parameters.
04
Excessive Data Exposure
Reviewing whether API responses return more data than is required by the client, exposing sensitive fields that could be harvested by an attacker.
05
Rate Limiting & Resource Consumption
Testing whether API endpoints enforce appropriate rate limits and whether resource consumption can be exploited to degrade service or enumerate data at scale.
06
Security Misconfiguration
Assessment of CORS policy, security headers, verbose error messages, exposed debugging endpoints, and unnecessary HTTP methods.
Scope
Is your API part of a web application test, or its own assessment?
Most web application and mobile app engagements include the API behind the application. Focused API penetration testing is only required where there is no front-end consumer in scope.
| Factor | Included in the web application price | Adds testing time | Scoped as API testing |
|---|---|---|---|
| User roles | The roles in scope are tested in the application and in its API together. | Each additional role adds access control paths to test, so testing time grows with the number of roles. | Roles alone do not create separate API scope. |
| Tenants | Tenant isolation is tested in the application and in its API together. | Each additional tenant and tenancy boundary adds testing time. Multi-tenant products are usually scoped as SaaS testing. | Tenants alone do not create separate API scope. |
| Authentication methods | Authentication the API shares with the application, such as login, sessions, tokens or single sign-on. | Additional authentication flows, such as MFA or several identity providers, add testing time. | Authentication used only by the API, such as partner API keys, client credentials or mutual TLS, is scoped as API testing. |
| Endpoints | Endpoints the application's own front end calls, tested through the application. | A larger or more complex application, or a GraphQL or multi-service backend, adds testing time. | Endpoints the front end does not call, such as public, partner, internal or admin APIs, are scoped as API testing based on their number and complexity. Endpoints called only by a mobile app belong to mobile application testing. |
| Integrations | Integrations the application depends on, such as identity providers, payment callbacks and inbound webhooks. | Each additional integration, and any custom handling of third-party data, adds testing time. | An API you provide for customers or partners to build against is scoped as API testing. |
| Business logic | Standard forms, dashboards and create, read, update and delete functions. | Multi-step workflows, approvals, payments and custom rules add testing time in proportion to their complexity. | Business logic alone does not create separate API scope. |
Pricing
From £2,100
for API penetration testing
Not sure where your application fits? A 30-minute scoping call is free and gets you a fixed written quote.
No obligation · Strictly confidential · Reply within one business day
Pricing Examples
| Simple REST API Up to 20 endpoints, one role | £2,100 - £2,550 |
| Standard API 21 to 50 endpoints, or multiple roles | £2,550 - £4,400 |
| Large API More than 50 endpoints, or multiple authentication methods | £4,400 - £6,650 |
| Multiple APIs or microservices Several APIs tested together, or more than 100 endpoints | £6,650 - £9,450+ |
Indicative ranges only. Where more than one description fits, the higher row applies. Your exact price is confirmed after a short scoping conversation. See full service pricing.
Compare all our penetration testing services.
What's Included
- Fixed-price proposal agreed before testing starts
- Manual, consultant-led testing. Not automated scans
- Pentest report within 2 business days, with findings mapped to the OWASP API Top 10
- Free focused retesting included to verify remediation
- Debrief call and Exploitr platform access at no extra cost
Ready to secure your APIs?
Our team will review your API's scope and provide a tailored testing proposal that fits your timeline and budget.
Common Questions
API penetration testing: frequently asked questions
API penetration testing starts from £2,100 for a simple REST API of up to 20 endpoints with one role, rising to £9,450+ for several APIs or microservices tested together, or more than 100 endpoints. The price depends on the number of endpoints, user roles and authentication methods in scope, and GraphQL APIs usually need more testing time.
Our penetration testing pricing guide compares costs across every service.
Most API tests take 2-6 days depending on the number of endpoints, user roles, authentication methods and API architecture. Reports are delivered within 2 business days of testing completion.
Yes, we can reverse-engineer and test undocumented APIs through traffic analysis, endpoint discovery, and behaviour observation. Testing is more efficient when OpenAPI/Swagger documentation or Postman collections are provided.
If you have a web application or mobile application that consumes the API, we'd highly recommend focusing testing through one of those services if you do not have API documentation available.
Yes, GraphQL APIs have a distinct attack surface including introspection abuse, deeply nested query attacks, and broken authorisation between operations. We test these specifically as part of GraphQL engagements.
Most testing activities are designed to be non-disruptive. However, certain tests such as rate limit abuse or resource exhaustion may cause temporary performance degradation. We can coordinate testing to minimise impact, and we always recommend testing against staging environments where possible.
Yes, for the endpoints your application's own front end calls. They are tested through the application in a web application or SaaS test, and a larger or more complex backend adds testing time.
An API that partners or customers call, authentication used only by the API (such as API keys or mutual TLS), and endpoints the front end never calls are scoped as API testing and priced in the same quote. If there is no web application, the API is priced as its own assessment. See the full breakdown above.
Yes, internal API testing can be performed from within your network or via a provided VPN connection. Internal APIs are often less rigorously tested than public-facing endpoints and frequently contain significant vulnerabilities.
We work with you to understand your authentication mechanisms and obtain necessary credentials or tokens for testing. We can test a variety of authentication methods including API keys, OAuth, JWT, and custom schemes. We also test for weaknesses in token handling and session management.