API penetration testing, where your data really lives.
Manual API security testing for REST and GraphQL APIs — focused on broken authorisation, authentication flaws and business logic, mapped to the OWASP API Security Top 10.
APIs expose your data and logic directly — often with less protection than your website.
Every modern application, mobile app and integration runs on APIs. They expose your data and business logic directly, and the most common API flaw — broken object-level authorisation — lets one user read or change another user’s data simply by changing an ID.
Automated tools struggle to find these issues because they need to understand who should be allowed to do what. We test every endpoint with an account for each role, and show exactly where your API trusts too much.
Every endpoint, every role.
Testing is mapped to the OWASP API Security Top 10 and your own authorisation model.
Object-level authorisation
Whether users can access or change objects that belong to someone else.
Function-level authorisation
Whether users can call administrative or privileged functions.
Authentication
Tokens, API keys, OAuth flows and session handling.
Property-level exposure
Excessive data in responses and mass assignment of protected fields.
Business flows
Abuse of sensitive flows such as payments, sign-ups or transfers.
Resource consumption
Rate limiting and protection against abuse and cost exhaustion.
Injection
Injection flaws through parameters, headers and payloads.
Server-side request forgery
Requests the API can be tricked into making on an attacker’s behalf.
Inventory & versions
Old, undocumented or shadow endpoints that are still reachable.
How we test.
AI-assisted speed for the repetitive work. Senior, manual testing for judgement, exploitation and evidence.
Scope
Agree endpoints, documentation, roles and credentials.
Map
Build a model of endpoints, objects and permissions.
Test
Manual testing of every endpoint across roles.
Exploit & verify
Confirm impact safely and remove false positives.
Report & retest
Clear findings, fix priorities and revalidation.
Choose the right starting point.
With documentation
An OpenAPI or Swagger file or Postman collection gives the fullest coverage in the time available.
Without documentation
Discovering endpoints from your applications and traffic, as an attacker would.
Mobile and partner APIs
The APIs behind your mobile apps and partner integrations, which are often overlooked.
Fixed price, agreed before testing starts.
Penetration tests are priced per consultant day at £795 + VAT per consultant day. You get a fixed price in a statement of work after a short scoping call — no hidden day rates.
Typically 2–4 days depending on the number of endpoints and roles. Large or multiple APIs are quoted individually.
- Senior, hands-on testing by the person who scopes it
- Live findings on the client platform
- Report with executive summary and remediation
- Retest terms agreed up front
Evidence you can act on — and share.
Executive summary
Plain-English risk, business impact and priorities for leadership and boards.
Attack paths
How individual weaknesses chain together into real-world impact.
Technical findings
Evidence, CVSS scoring and specific, practical remediation for every finding.
Live findings
Findings published to the SMARTSEC client platform as the engagement runs.
Retest
Independent revalidation of fixes, with retest terms agreed in the statement of work.
Debrief
A walkthrough of the results with your technical team and stakeholders.
What we typically find.
Examples of the issue types this kind of test regularly uncovers — illustrative, not client data.
- Broken object-level authorisation exposing other users’ records
- Administrative functions callable by standard users
- Excessive data returned in API responses
- Mass assignment of protected fields such as roles or balances
- Missing or weak rate limiting on sensitive endpoints
- Weak token validation and long-lived credentials
- Undocumented or deprecated endpoints still in production
- Race conditions in transfers, balances or limits
Evidence for the people who ask.
- Banking partners and enterprise clients — API security evidence is a common due diligence requirement.
- Open banking and fintech — APIs that move money or expose financial data need rigorous testing.
- PCI DSS — APIs in scope of cardholder data environments need testing.
- DORA — testing of ICT systems that support critical or important functions.
API questions.
What is API penetration testing?
A manual security assessment of an API, testing authentication, authorisation, data exposure and business logic across every endpoint and role — mapped to the OWASP API Security Top 10.
Do you test GraphQL?
Yes. We test REST and GraphQL APIs, including GraphQL-specific issues such as introspection exposure and query abuse.
What do you need from us?
Ideally API documentation (OpenAPI/Swagger or a Postman collection), the base URLs and test credentials or keys for each role.
Can you test the API behind our mobile app?
Yes. Mobile backends are often the most exposed APIs a business has, and are frequently left out of scope.
How long does an API test take?
Typically 2–4 days, depending on the number of endpoints, roles and complexity.
Is API testing included in a web application test?
The APIs behind your web application are tested as part of a web application test. Standalone APIs, partner APIs and mobile backends are best scoped as an API test.
Need an API tested?
Share your documentation and roles — we’ll confirm scope and a fixed price.