AtlantSECURITY Let’s talk
Menu

Penetration Testing

API Pentest: Penetration Testing That Proves Which Records a Token Can Reach. Report in 14 Days, Free Retest.

The finding that matters in an API is a valid, low-privilege token reaching a record it was never issued for.

Our API pentest is scoped around the six places where authorisation is decided, from object level access to the inventory of versions and consumers. REST, GraphQL and gRPC are tested by hand against the OWASP API Security Top 10 (2023). Every finding is a replayable request and response pair with its business consequence, mapped to the PCI DSS, SOC 2, ISO 27001 or GDPR clause your auditor will cite. Fixed price, report in 14 days, free retest.

  • Every endpoint called with every role and a second account, so cross-account access is proven or ruled out
  • Findings delivered as request and response pairs your developers can replay in minutes
  • Written rules of engagement: test accounts only, agreed request ceilings, a named contact and a stop condition
Scope My API Pentest View pricing See Client Results
OWASP API Top 10PCI DSS 11.4SOC 2ISO 27001 A.8.29NIST SP 800-115GDPR Art. 32
API pentest: a software engineer’s desk with a laptop angled away and an annotated printed API specification - Atlant Security

Senior-led testing that starts from whatever you have: an OpenAPI specification, a Postman collection, a GraphQL schema or raw traffic.

See a sample pentest report ↗
Cover of the illustrative penetration test report

SEE THE DELIVERABLE

See what a useful
penetration test report looks like.

Review a combined engagement covering web, REST and GraphQL APIs, gRPC, SaaS tenant isolation, Android and iOS, networks, cloud, identity and CI/CD. Includes technical evidence, remediation and retest criteria.

62 pages. 24 findings. 14 charts, diagrams and matrices.
Illustrative penetration test. The organisation, systems and findings are fictional.

Get the sample report

A free PDF. Enter your email and company name, and we’ll email you a download link.

Use a company email address. Free and disposable email services are not accepted.

We’ll email you a download link and an invitation to discuss your security assessment needs. Privacy policy.

DEFINE YOUR SCOPE

Turn your testing requirements into a clear RFP.

Build one request for your applications, APIs, networks, and cloud. Review the scope, download your document, and send a copy to your inbox and our team.

Only questions relevant to your scope. Estimates and “not sure” are welcome.

200+Security Assessments
14Countries
14Days to Report
FreeRetest After Remediation
Alexander Sverdlov, founder of Atlant Security
Alexander SverdlovFounder, Atlant SecurityCISSP, CEH, CHFI, Mandiant

Leads every API pentest personally, runs the remediation workshop with your developers and signs the attestation letter your auditor reads.

Connect on LinkedIn

01 / THE DETAIL

What an API Pentest Actually Tests

An API pentest is scoped by authorisation decision, because that is where the data is protected and where it leaks. Six decision points cover almost every API we have assessed, from a single REST service behind a mobile app to a GraphQL gateway in front of a fleet of microservices.

Object and property level authorisation

Every endpoint that takes an identifier is called with a second account’s identifier. Every write is sent fields the client never shows: role, tenant_id, price, email_verified. API1 and API3, where customer records leak.

Authentication and token handling

JWT signature and algorithm checks, expiry and revocation on logout, refresh token rotation, API keys in query strings and logs, OAuth redirect and PKCE handling, and whether a token issued to the mobile app is accepted by the admin API.

Function level authorisation

Admin, support and internal routes called with an ordinary user’s token: the DELETE on a resource the UI only reads, the /admin prefix, the export endpoint the front end hides, the method the gateway forgot to list.

Business flows and resource limits

Signup, checkout, coupon redemption, password reset and OTP verification replayed, raced and run at volume. Query depth, page size, upload size and per-token rate ceilings are tested where they are enforced and where they are missing.

Server-side requests and service trust

Every parameter that accepts a URL, from webhooks to image import, is pointed at internal addresses and cloud metadata endpoints. Calls between your own services are checked for a shared secret, a trusted header or an unauthenticated port.

Inventory and upstream consumption

The v1 that still answers, the staging host in public DNS, the debug route left in a handler, and the partner API whose response is written to your database without validation. API9 and API10.

Each decision point produces its own question for the test, and its own line in the report.

02 / THE DETAIL

The Attack Paths That Repeat in APIs

These are the findings that recur across the APIs we assess. Every component involved is patched and current. The weakness is in which token can reach which record, and it shows up only when a second account asks.

Sequential identifiers and a check that stops at the token

GET /customers/1042 returns the record for any valid token. The handler verifies the signature and never compares the owner. With sequential IDs and no rate ceiling, the customer table is one scripted loop away.

Mass assignment on the profile update

PATCH /users/me accepts the fields the form shows and, because the handler binds the whole JSON body to the model, also role, tenant_id and email_verified.

A token that outlives its session

Logout clears the client and leaves the access token valid until expiry. Refresh tokens are reused without rotation, the signing key is shared with staging, and the alg header is still read from the token.

Admin routes guarded by the user interface

The web app hides the export button from ordinary users. The API serves /admin/export to any token with a valid signature, because the role check lives in the front end.

Business flows with no ceiling

A six-digit OTP with unlimited attempts, a coupon endpoint that honours the same code in parallel requests, a GraphQL query that nests until the database gives up.

Shadow versions and trusted upstreams

/api/v1 was removed from the documentation and still runs the authorisation code from three releases ago. A supplier’s API response is written straight into the order table, HTML and all.

The finding engineering leads remember: a free account to the full customer table, with every component patched and every request individually valid.

03 / THE DETAIL

What the Report Has to Prove, and to Whom

An API pentest report has two readers. Your developers want the exact request that crossed the boundary, the response that proved it, and the fix. Your auditor wants evidence that the API was tested independently against a recognised method and that the findings were closed. The report carries both: a findings register of replayable request and response pairs, and an executive summary with each finding mapped to its OWASP API Security Top 10 category and the clause it bears on.

For card-data flows the scope is written to PCI DSS requirement 11.4. For a SOC 2 audit the report, the retest record and the attestation letter are the CC7.1 evidence. For ISO/IEC 27001 the report answers Annex A 8.29. APIs that carry patient data fall under the HIPAA Security Rule evaluation standard, and EU financial entities under DORA Article 25, with threat-led testing as a separate regime for designated entities.

What each regime expects, and what in the deliverable answers it.
Two engineers at a whiteboard reviewing a printed sequence diagram of an API authorisation flow

04 / THE DETAIL

Rules of Engagement for Production APIs

Testing an API that serves live customers is a governance exercise as much as a technical one. Before the first request is sent, both sides sign rules that your engineering lead and your risk owner can read.

  • Test accounts only. Cross-account checks run between accounts we create or you provision. The proof of a finding is one test record reaching another; real customer records stay untouched.
  • Agreed request ceilings. Volume, replay and race tests run under a ceiling you set, in a window you choose. Denial-of-service techniques stay out of scope; payment and messaging providers are exercised with sandbox credentials.
  • A named contact and a stop condition. One escalation contact on each side, reachable throughout, and a written condition under which testing halts immediately, such as an error-rate alarm on the gateway.
  • Evidence handling. Personal data that appears in a response is redacted at capture, held encrypted for the engagement only, and destroyed on a documented date. Every token we are issued is revoked at the end.
  • Platform boundary respected. Your gateway, identity provider and cloud platform are tested at the configuration you control, inside AWS’s customer penetration testing policy, Microsoft’s Azure rules of engagement and Google Cloud’s acceptable use policy.

05 / THE DETAIL

How the Engagement Runs

Five steps, fixed price agreed at the first one, report inside fourteen days of the third.

1

Scoping call

Which APIs, how many endpoints, which roles, tenants and consumers, which audit the report is for. Fixed price and timeline in writing, proposal within 24 hours.

2

Rules of engagement

Test accounts per role, request ceilings and windows for volume tests, an escalation contact on each side, and a written stop condition.

3

Manual testing

Senior-led. Every endpoint called with every role and a second account, every flow replayed and raced. Tools map the surface; people find the authorisation gaps.

4

Report and workshop

Findings register with replayable request and response pairs, executive summary with OWASP and regulatory mapping, and a live remediation session with your developers.

5

Retest and attestation

Free retest after you deploy the fixes, then an attestation letter signed by a named qualified individual for your auditor or your enterprise customer.

06 / PRICING

API Pentest Pricing

An API of up to 50 endpoints is one fixed price. The application, mobile app or platform that consumes it can be added in the same proposal with volume pricing, and you approve the total before anything starts.

ScopeWhat is coveredTestingPrice
APIUp to 50 endpoints, REST, GraphQL or gRPC, all roles5-7 daysFrom $4,000
Web application1 application, all roles7-10 daysFrom $5,000
Mobile app plus its APIiOS or Android, with the backend API10-14 daysFrom $6,000
SaaS multi-tenant platformTenant isolation, roles, SSO and integration tokens10-14 daysFrom $6,000
Cloud infrastructureAWS, Azure or GCP: IAM, storage, metadata, CI/CD7-10 daysFrom $6,000
External network perimeterInternet-facing ranges, DNS, mail, remote access5-7 daysFrom $4,000

Every scope includes the findings register with replayable requests, the executive summary with OWASP and regulatory mapping, the remediation workshop, a free retest and the attestation letter. Larger API estates, with more than 50 endpoints or several services, are priced in one proposal with volume pricing. The full price list is on the pricing page.

For small projects and ad-hoc work outside our pre-agreed packages or retainers, our standard hourly rate is $460.

07 / THE DETAIL

API Pentest or Vulnerability Scan

Two controls with different jobs, often bought under one name. NIST SP 800-53 lists them separately, as RA-5 and CA-8, and the audit file needs both.

A scan reads the software. A pentest reads the authorisation decisions. The audit file has a line for each.

Need the scanning control as well? Our vulnerability assessment covers it on a schedule.

08 / THE DETAIL

Who Commissions an API Pentest

SaaS companies with a public API and an enterprise customer asking for the latest pentest report
Mobile app teams whose backend API is the real attack surface behind the app
Fintech and payment platforms with card or account data behind REST or GraphQL endpoints
Healthcare platforms exposing patient records through APIs under the HIPAA Security Rule
Engineering organisations with internal microservices that trust one another’s calls
Teams preparing for a SOC 2, ISO 27001 or PCI DSS audit that asks for penetration test evidence

09 / THE DETAIL

Find Out Which Records Your Tokens Can Reach

One scoping call. Bring your OpenAPI specification, your last pentest report, the security questionnaire your customer sent, or nothing at all. You will leave with a scope written as questions, a fixed price, and a date for the report.

Scope My API Pentest

10 / THE DETAIL

Book the Scoping Call

Choose a time for your scoping call.

Or visit our contact page ↗

11 / FAQ

API Pentest FAQ

What is an API pentest?
An API pentest is a manual penetration test of your REST, GraphQL and gRPC endpoints. Every endpoint is called with every role and a second account, every write is sent fields it should refuse, every URL parameter is pointed at an internal address, and every business flow (signup, checkout, reset, OTP) is replayed and raced. The output is a set of proven paths, each a request and response pair your developers can replay, with its business consequence and its OWASP API Security Top 10 category.
How is an API pentest different from an API vulnerability scan?
A scanner matches component versions to known CVEs and records what one token gets back from each endpoint. An API pentest starts from a question your auditor would ask, such as whether one customer’s token can read another customer’s invoice, and answers it with two accounts, chaining each result into the next request and stopping at the agreed boundary. NIST SP 800-53 treats them as separate controls, RA-5 for scanning and CA-8 for penetration testing, and PCI DSS requirement 11.4 asks for the pentest specifically.
What do you need from us to start?
Two test accounts per role, so cross-account checks run between records we own. An OpenAPI or Swagger specification, a Postman collection or a GraphQL schema speeds up the mapping phase; without one we enumerate the surface from the web front end, the mobile app, partner documentation and traffic. If you run an API gateway, a copy of its route configuration shows us the versions and hosts the documentation has forgotten.
Do you test GraphQL and gRPC?
Yes. For GraphQL we test introspection exposure in production, query depth and complexity limits, batching and aliasing against rate limits, field-level authorisation on nested objects, mutation authorisation, and subscriptions over WebSockets. For gRPC we review the proto definitions, test server reflection, check per-method authorisation and examine how metadata carries identity. All three are covered by the same engagement and fixed price.
How do you prove cross-account access without touching real customer data?
Every authorisation test runs between accounts we created or you provisioned. The proof of a broken object level authorisation finding is test account A retrieving test account B’s record, captured as the request and the response. Where an identifier space is enumerable we demonstrate it against the test records and describe the full extent in the report; we never pull the production customer table. Personal data that appears by accident is redacted at capture and destroyed on a documented date.
Do you test against production?
Where the question requires it, yes, under written rules of engagement agreed before anything starts: test accounts only, request ceilings for volume and race tests, agreed windows, a named escalation contact on each side and a written stop condition. A staging environment that runs the same authorisation code, gateway configuration and identity provider is an equally valid target, and for payment and messaging flows usually the better one. The scoping call decides this per API.
How long does an API pentest take?
An API of up to 50 endpoints takes five to seven days of testing, with the report delivered within fourteen days of the start. Larger estates, or an API tested together with the application in front of it, receive one timeline in the proposal. Critical findings are reported the day they are confirmed; we never hold an urgent finding for the final report.
What does an API pentest cost?
From $4,000 for an API of up to 50 endpoints, fixed in writing after the scoping call, with the proposal in your inbox within 24 hours. The price includes the findings register, the executive summary with OWASP and regulatory mapping, the remediation workshop, one free retest and the attestation letter. Larger or combined scopes, such as the API together with the web application or mobile app that consumes it, are priced in one proposal with volume pricing; you approve the total before anything starts.
Which audits and regulations accept the report?
PCI DSS v4.0 requirement 11.4 for any API that touches card data. SOC 2, where auditors expect a penetration test report as evidence under CC7.1 and CC4.1. ISO/IEC 27001:2022 Annex A 8.29 and A 8.8. The HIPAA Security Rule evaluation standard at 45 CFR 164.308(a)(8) for APIs carrying patient data. GDPR Article 32(1)(d). NIS2 Article 21(2)(e) and (f), and DORA Article 25 for EU financial entities. For CMMC Level 2, a pentest is accepted assessment evidence for practice CA.L2-3.12.1. The executive summary names the clause next to each finding.
What does the report include?
An executive summary for leadership and auditors, with each finding mapped to its OWASP API Security Top 10 category and the regulatory clause it bears on. A technical findings register with the exact request, the response that proved the issue, the affected endpoints, a severity rating, and remediation guidance written at the level of the handler, middleware or gateway rule that has to change. A methodology section written to NIST SP 800-115. After remediation, the retest record and the signed attestation letter.
Do you retest after we fix the findings?
Yes, one round of retesting is included at no charge. After your developers deploy the fixes, every finding is replayed from the original request, closed or reopened with evidence, and the attestation letter is issued for your auditor, your enterprise customer or your board. The remediation workshop, where we walk your developers through each finding live, is included as well.

12 / THE DETAIL

Related Services

Penetration testing - Network pentest - Web application pentest - Mobile app pentest - SaaS pentest - Cloud pentest - Vulnerability assessment - SOC 2 readiness - SaaS virtual CISO - continuous AI penetration testing with Pentestas