API Penetration Testing
REST and GraphQL APIs against the OWASP API Security Top 10 — BOLA, excess data exposure, mass assignment, rate limiting and injection flaws.
API penetration testing is a manual assessment of REST and GraphQL APIs against the OWASP API Security Top 10. Passeca finds and exploits the flaws unique to APIs — broken object-level authorisation (BOLA), excess data exposure, mass assignment, missing rate limiting and injection — that web-application scanners cannot see, and reports each with evidence, reproduction steps and developer-ready remediation.
What concrete vulnerabilities do we test for?
Mapped to the OWASP API Security Top 10. Authorisation at the object and property level is where the highest-impact API flaws live.
Broken object-level authorization (BOLA)
The #1 API risk — endpoints that fail to check the caller owns the object in the request, allowing reading or modifying other users' records by ID manipulation.
Broken object-property-level authorization
Endpoints that expose more fields than intended (excess data exposure, such as sensitive fields a client never renders but an attacker reads straight from the response), or permit writes to fields the user should not control (mass assignment of role, account, admin-flag or price fields through auto-binding without allow-lists).
Rate limiting & resource exhaustion
Missing or weak throttling enabling credential stuffing, brute force, enumeration and denial-of-wallet through expensive endpoints.
Injection (SQLi / command / GraphQL)
Untrusted input reaching query, command or GraphQL resolvers — including batch-query abuse and introspection left enabled in production.
Methodology for APIs
OWASP API Security Top 10 drives the test classes; PTES provides the engagement framework. Authorisation is tested across every role and object type.
We begin from the API contract — OpenAPI/Swagger when provided, else enumerated — and authenticate as each defined role. For every object-level endpoint we test whether the caller can access, modify or delete objects they do not own (BOLA), and whether the response exposes fields beyond what the role should see.
For GraphQL we additionally test introspection exposure, query depth and complexity limits, alias-based batching attacks, and field-level authorisation. Rate limiting, authentication, session handling and injection are exercised throughout, and business-logic abuse is assessed manually per endpoint.
Example findings from real (anonymised) API tests
APIs are where authorisation flaws concentrate. These are representative of what Passeca finds in production.
BOLA on /accounts/{id} returned any account by enumeration
An authenticated caller could read every account record in the system by incrementing the ID — full customer-data exposure.
Mass assignment accepted an isAdmin field on profile update
A JSON property in the update body was auto-bound to the user object, granting administrator privileges to any authenticated user.
GraphQL introspection enabled in production exposed full schema
An attacker enumerated every type, field and mutation — including administrative mutations not present in the public UI.
No rate limiting on /login enabled credential stuffing at scale
The authentication endpoint had no throttling or lockout, allowing high-speed password spraying against the whole user base.
Findings are anonymised and paraphrased. Specific reproduction steps are reserved for the engagement report.
How long does an API pentest take, and what does it cost?
Driven by endpoint count, object types, number of roles, and whether the API contract (OpenAPI) is provided.
| Engagement size | Typical duration | Price band |
|---|---|---|
| Focused — single REST service | 3–5 days | Price on request |
| Standard — multi-service + GraphQL | 1–2 weeks | Price on request |
| Complex — multi-tenant API estate | 2+ weeks | Price on request |
Use the free pentest scoping tool for a precise estimate.
What's in the report?
Documented for developers, API owners, leadership and auditors.
- Executive summary — API risk in business terms.
- Graded findings — CVSS and business impact, with the vulnerable endpoint and method.
- Reproduction requests — exact HTTP requests and responses as evidence.
- Remediation guidance — authorisation patterns, allow-lists, schema hardening.
- Compliance mapping — PCI DSS, ISO 27001, SOC 2, DORA, NIS2.
- Remediation retest — fixes retested within the engagement window.
Which compliance requirements does this satisfy?
| Framework | Relevant requirement | How the pentest maps |
|---|---|---|
| PCI DSS | Req. 11.4 | Penetration testing of payment APIs in scope |
| ISO 27001:2022 | A.8.25 / A.8.29 | Secure development lifecycle & security testing |
| SOC 2 | CC4.1 | Monitoring of system performance & security |
| DORA | Art. 24–25 | Digital operational resilience testing |
| NIS2 | Art. 21 | Risk-based security measures, evidenced |
API pentest, answered
Scoping, methodology, REST vs GraphQL and compliance for API testing.
What is API penetration testing?
How is API testing different from web application testing?
Which APIs do you test — REST and GraphQL?
Do you need API documentation to test?
Which compliance requirements does API pentest satisfy?
Can you test APIs in production without disrupting users?
How long does an API pentest take?
List your endpoints and roles — get a day estimate
The free pentest scoping tool converts your API surface into a day estimate and price band, then hands to Passeca's offensive-security team for a precise quote.
Related