API Security Testing
for the Interfaces
Your Business Runs On
API security testing
Hands-On Testing for REST, GraphQL, gRPC and SOAP APIs
APIs expose your data and business logic directly, often with less protection than the applications in front of them. iSpyCyber testers map every endpoint, operation and object, then test authorisation, authentication and business flows by hand, aligned to the OWASP API Security Top 10. Every finding is validated, risk-rated and delivered with fixes your developers can apply.
Why organisations choose iSpyCyber
Authorisation first
Broken object-level and function-level authorisation are the most common serious API flaws, so we test every object and operation for every role.
Every API style
REST, GraphQL, gRPC, SOAP and WebSocket interfaces, including internal, partner and mobile back-end APIs.
Near-zero noise
Automated fuzzing is triaged and reproduced by hand, so your team only receives real, exploitable issues.
Developer-ready fixes
Request and response evidence, reproduction steps and framework-specific remediation for every finding.
Safe for production
Agreed rate limits, test data and rules of engagement protect live services and customer records.
Continuous validation
Retesting confirms every fix, and iefyx, our AI-native VAPT platform, keeps API exposure visible between engagements.
Coverage
What We Test in Your APIs
Our testers work through the OWASP API Security Top 10 and beyond, testing each API against its specification and against how it actually behaves.
Object-level authorisation
BOLA and IDOR across every object identifier, tenant boundary and nested resource.
Authentication and tokens
OAuth 2.0 and OpenID Connect flows, JWT signing and validation, API keys, mTLS and token lifetime.
Function-level authorisation
Privileged operations, admin endpoints and HTTP method tampering reachable by lower-privileged callers.
Property-level exposure
Excessive data exposure, mass assignment and writable fields the client should never control.
Resource consumption
Rate limiting, pagination, batching, query depth and cost controls that prevent abuse and denial of service.
Business flows
Abuse of sensitive flows such as sign-up, checkout, transfers and OTP, including race conditions.
Injection and SSRF
SQL, NoSQL, command and template injection, and server-side request forgery through URL and webhook parameters.
GraphQL and gRPC specifics
Introspection, alias and batching abuse, query depth, resolver authorisation and protobuf message tampering.
Inventory and configuration
Shadow and deprecated versions, verbose errors, CORS, TLS and gateway misconfiguration.
Methodology
A Proven Six-Phase Testing Methodology
Aligned to the OWASP API Security Top 10, OWASP ASVS and NIST SP 800-115, and tailored to your API specifications, consumers and data.
- OWASP API Security Top 10
- OWASP ASVS
- OWASP WSTG
- NIST SP 800-115
- CVSS 3.1
1–3
weeks for a typical engagement
6
standards-aligned phases
100%
findings manually validated
01
- Days 1–2
Scope and plan
APIs, versions, environments, roles and test data agreed up front, with specifications and collections shared.
Key activities
- Collect OpenAPI, GraphQL schema, WSDL or proto files
- Agree rate limits, test windows and data handling
- Provision API clients and tokens for each role
- Output: Signed rules of engagement
02
- Days 2–3
Map and model
Every endpoint, operation and object mapped and compared with its documentation.
Key activities
- Enumerate endpoints, versions and hidden parameters
- Map objects, identifiers and trust boundaries
- Threat-model sensitive business flows
- Output: API inventory and test plan
03
- Days 3–7
Discover
Targeted fuzzing combined with hands-on testing of every role, operation and object.
Key activities
- Role-by-role authorisation matrix testing
- Schema-aware fuzzing with manual triage
- Business-flow and rate-limit abuse testing
- Output: Candidate vulnerability list
04
- Days 5–9
Exploit and validate
Impact safely proven, weaknesses chained and false positives eliminated.
Key activities
- Prove data access or privilege gain with proof of concept
- Chain findings into realistic attack paths
- Rate every finding with CVSS and business context
- Output: Validated, risk-rated findings
05
- Days 9–12
Report and debrief
Executive summary, technical findings and a live walkthrough with your API owners and leadership.
Key activities
- Executive summary for leadership
- Request and response evidence for each finding
- Live walkthrough and Q&A with your teams
- Output: Final report and debrief
06
- After remediation
Fix and retest
Remediation guidance, developer Q&A and retesting to confirm every issue is closed.
Key activities
- Developer Q&A while fixes are built
- Retest every remediated finding
- Updated report confirming closure
- Output: Retest report
Effort distribution
Where the testing time goes
Most of every engagement is spent on hands-on authorisation and business-flow testing, not on running scanners. Percentages are indicative for a typical grey box API test.
Quality built into every phase
Every finding reproduced
Nothing is reported until a tester has reproduced it by hand.
Risk rated in context
CVSS scores adjusted for the data and callers each API serves.
Agreed rules of engagement
Rate limits and test data protect live services.
Closure confirmed
Retesting proves each fix actually works.
Engagement models
Choose the Testing Approach That Fits Your Risk
Every approach uses the same methodology. The difference is how much context our testers start with, and how deep they can go.
Black box
Only the API base URL, simulating an attacker discovering and probing your interfaces. Best for validating public and partner API exposure.
Grey box
Specifications, collections and tokens for each role to test authenticated operations in depth. Best for most APIs, with the strongest balance of depth and efficiency.
White box
Source code, gateway configuration and architecture access for the deepest coverage. Best for payment, banking and other high-risk or regulated APIs.
Not sure which approach you need?
Our specialists will recommend a scope based on your API estate, consumers and compliance obligations.
Deliverables
Reports Built for Leadership, Engineering and Auditors
Clear business context for decision-makers, precise technical detail for engineers and evidence your auditors can rely on.
Executive summary
Overall API risk posture, key themes and business impact in plain language for leadership and boards.
Technical findings
Every vulnerability with CVSS rating, affected endpoints, request and response evidence and reproduction steps.
Remediation roadmap
Prioritised, framework-specific fix guidance so teams resolve the highest-impact issues first.
Retest report
Independent confirmation of which findings are closed, ready to share with partners and auditors.
Supports your compliance and assurance requirements
- OWASP API Security Top 10
- OWASP ASVS
- PCI DSS
- ISO/IEC 27001
- SOC 2
- RBI guidelines
- DPDP Act 2023
- CERT-In guidelines
- NIST SP 800-115
- HIPAA
- GDPR
iSpyCyber provides independent security testing that supports these requirements. Certification and attestation are issued by accredited bodies and licensed auditors.
API security testing for every industry
The basics
What is API security testing?
API security testing is a hands-on assessment of your application programming interfaces that identifies and safely exploits weaknesses in authentication, authorisation, data handling and business logic, then explains the impact and how to fix each issue.
Which API types do you test?
We test REST, GraphQL, gRPC, SOAP and WebSocket APIs, whether they are public, partner-facing, internal or the back end of a web or mobile application.
Is an API scan not enough?
Scanners are poor at authorisation and business logic, which is where most serious API flaws sit. Our testers check every object and operation for every role, which automated tools cannot reliably do.
Working with us
What do you need from us to start?
Ideally an OpenAPI or Swagger file, GraphQL schema, WSDL or proto definitions, a Postman collection, and test accounts or tokens for each role. We can also test with no documentation in a black box engagement.
How long does an API penetration test take?
Most engagements take one to three weeks, depending on the number of endpoints, operations and roles in scope. We confirm the timeline during scoping.
Will testing affect our live APIs?
We agree rate limits, test windows and dedicated test data before testing begins, and can test in a staging environment that mirrors production.
Do you retest after we fix the issues?
Yes. We retest remediated findings and issue an updated report confirming which issues are closed.
Get started
Secure Every Endpoint.
Before Attackers Find It.
Talk to our API security specialists about a scoped penetration test for your REST, GraphQL, gRPC or SOAP interfaces.
- ISO/IEC 27001 and ISO 9001 certified
- 40+ enterprise and government clients
- 15+ countries