What Gets Tested

Scanners understand web pages far better than they understand APIs, so API testing is mostly manual. The checks that matter most are:

  • Broken object-level authorisation (BOLA): can user A fetch or change user B's records by changing an ID?
  • Broken function-level authorisation: can an ordinary user call admin endpoints?
  • Authentication and token flaws: weak JWT validation, long-lived tokens, and password reset abuse.
  • Excessive data exposure and mass assignment: APIs that return or accept more fields than the client should ever see or set.
  • Rate limiting and resource abuse: brute force, enumeration, and expensive-query abuse.
  • Injection and SSRF through parameters, headers, and request bodies.
  • Improper inventory: old API versions and undocumented endpoints that are still reachable.
  • GraphQL specifics: introspection exposure, query depth and batching abuse, and field-level authorisation gaps.

What I Need From You

  • An OpenAPI/Swagger specification or Postman collection. Without one, I will map the API from traffic, which takes longer.
  • Test accounts at different privilege levels, plus at least two accounts at the same level so cross-tenant access can be tested properly.
  • A staging environment, or an agreed production window.

How the Engagement Works

  1. Scoping call. We agree the assets, user roles, testing window, and rules of engagement, and I send a fixed quote.
  2. Access and authorisation. You provide written permission, test accounts, and any IP allow-listing needed.
  3. Testing. Automated coverage first, then manual testing for the issues scanners cannot find.
  4. Report and walkthrough call. Every finding comes with severity, proof of concept, impact, and a fix your developers can act on.
  5. Free retest. Once you have fixed the findings, I verify them and update the report.

What You Receive

  • An executive summary for management and a technical section for developers.
  • Every finding with a severity rating, proof-of-concept steps, and business impact.
  • Remediation guidance specific to your stack, not generic advice.
  • A walkthrough call with your team.
  • A free retest and an updated report showing which issues are closed.

Pricing

API security testing in India typically costs between ₹40,000 and ₹1,20,000, depending on endpoint count and authentication complexity. A fixed quote follows scoping, and the retest is included. Ranges for other test types are in the penetration testing cost guide.

Who This Is For

  • Companies whose product is an API, or whose mobile and web apps sit on top of one.
  • Teams exposing partner or public APIs.
  • Multi-tenant SaaS platforms where tenant isolation is critical.
  • Teams preparing for a compliance audit that includes application security testing.

About the Tester

Engagements are led by Mohd Abdullah Khan, a CEH v12 certified and ISO/IEC 27001:2022 Lead Auditor information security consultant with 3+ years of hands-on offensive security experience. Findings are prioritised by business impact, not by raw scanner output.

Frequently Asked Questions

Do you test both REST and GraphQL APIs?
Yes. REST is the most common, but GraphQL needs its own checks such as introspection, query depth, batching, and field-level authorisation.
Is API testing different from web application testing?
They overlap, but API testing goes deeper on authorisation logic, object-level access, and data exposure. If you have a web or mobile front end on the same API, I can cover both in one engagement.
What if we do not have API documentation?
I can map the API from traffic captured through the web or mobile client, though it takes longer than starting from a specification.
How long does API security testing take?
Most APIs take 3 to 7 business days of testing plus reporting, depending on endpoint count and roles. The exact timeline is confirmed during scoping.
Is a retest included?
Yes. I verify your fixes and update the report at no extra cost.