APIs fail differently from web applications. There is no UI to constrain what a caller sends, object identifiers are handed to the client by design, and a single missing authorization check exposes every record in a table. The OWASP API Security Top 10 exists because these failures repeat across almost every organization.
What we test
- Broken object-level authorization (BOLA) — the single most common and most damaging API flaw: reading or modifying another tenant's or user's objects by changing an identifier
- Broken authentication — weak or missing token validation, JWT algorithm confusion and key confusion, token replay, refresh-token handling, API key exposure
- Broken object property-level authorization — mass assignment of privileged fields, and excessive data returned in responses that the client filters out but the attacker does not
- Broken function-level authorization — administrative endpoints reachable by ordinary users, HTTP method and path confusion
- Unrestricted resource consumption — missing rate limits, expensive queries, pagination abuse, and in GraphQL, deeply nested queries, aliasing and batching attacks
- Unrestricted access to sensitive business flows — automation of flows meant for humans, such as bulk purchase, bulk invite or bulk lookup
- Server-side request forgery via URL parameters and webhooks
- Security misconfiguration — verbose errors, CORS, missing transport security, debug endpoints, unauthenticated introspection
- Improper inventory management — forgotten v1 endpoints, staging hosts reachable from the internet, undocumented shadow APIs
- Unsafe consumption of third-party APIs — trusting upstream responses without validation
How we scope it
Give us an OpenAPI or Swagger specification, a Postman collection, or a GraphQL schema, plus credentials for at least two accounts at each permission level — that second account is what makes tenant isolation testable. Where no specification exists, we map the API by proxying the client application and reviewing its traffic.
Who it is for
Multi-tenant SaaS platforms, open banking and fintech APIs, healthcare integrations moving ePHI, marketplaces with partner APIs, and any product where the mobile app and the web app share one backend — in which case testing the API once covers the surface both of them depend on.
Frequently asked
Can you test GraphQL?
Yes. GraphQL testing covers introspection exposure, field-level authorization, query depth and complexity limits, aliasing and batching abuse, and mutation authorization — the areas generic scanners consistently miss.
We have hundreds of endpoints. How is that scoped?
By unique functionality and authorization pattern rather than raw endpoint count. Endpoints sharing a controller and an authorization model are tested as a group, which keeps large APIs affordable to test properly.
Do you test webhooks and callbacks?
Yes — signature verification, replay protection, and SSRF through user-supplied callback URLs are all in scope.