Offensive Security

API Security Testing

REST, GraphQL, and gRPC testing for broken auth, BOLA, and data exposure.

Request This Service All Services

What it is

APIs fail differently from the applications in front of them. We test yours against its own specification and against what it actually accepts: object-level authorization on every endpoint, mass assignment, unbounded queries, and the undocumented or deprecated versions still answering in production.

How we do it

  1. 1

    Specification and surface discovery

    We work from your OpenAPI or GraphQL schema, then hunt for the endpoints and versions it does not mention but that still respond.

  2. 2

    Object-level authorization

    Every endpoint that takes an identifier gets tested with identifiers belonging to another account — BOLA is the most common serious API bug there is.

  3. 3

    Function-level authorization

    Administrative and privileged operations called with ordinary user tokens.

  4. 4

    Mass assignment and input binding

    We add fields the client never sends — role, tenant, balance, verified — and see which ones stick.

  5. 5

    Rate, cost and resource limits

    Pagination abuse, expensive GraphQL queries, and enumeration through endpoints with no throttle.

  6. 6

    Token and session handling

    JWT signature and claim validation, expiry, revocation and scope enforcement.

What's included

  • REST, GraphQL and gRPC coverage
  • BOLA/BFLA testing across every identifier-taking route
  • Mass assignment and schema-drift checks
  • Undocumented and deprecated version discovery
  • OWASP API Top 10 alignment
  • Ready-to-run reproduction collection

Who needs it

  • Platforms exposing partner or public APIs
  • Mobile and SPA backends where the API is the real attack surface
  • Teams whose API surface has outgrown its documentation

Deliverables

  • Endpoint-by-endpoint authorization matrix
  • Postman or curl collection reproducing each finding
  • Schema drift report — what is live but undocumented
  • Remediation notes per endpoint

Compliance relevance

OWASP API Top 10PCI DSSSOC 2GDPR

Frequently asked questions

It is a good start and it speeds things up. But part of the value is finding what the spec omits: older versions, internal routes and debug endpoints that are still reachable.
Yes. GraphQL shifts the risk toward query depth and cost abuse, introspection exposure and resolver-level authorization, and we test all three.
At least two at the same privilege level and one at each higher level. Cross-account testing is impossible with a single account, and that is where the severe findings live.
New to penetration testing?

Our complete guide covers methodology, standards, what a good report contains, and how often to test.

Read the guide

Related services

Cloud Security Assessment

AWS, Azure, and GCP configuration and identity hardening reviews.

Learn More

Secure Code Review

Manual and assisted source review aligned to SAST findings.

Learn More

Web Application Pentesting

OWASP-aligned assessments uncovering logic flaws, injection, and auth bypasses.

Learn More