APIs Are the Modern Attack Surface.
BOLA is the new SQLi. Broken object-level authorization is the number-one risk in the OWASP API Security Top 10, and signature-based scanners do not catch it. We test REST and GraphQL the way attackers probe them: one object reference at a time.
Definition API penetration testing is manual adversarial assessment of REST and GraphQL APIs covering authentication, broken-object-level authorization (BOLA), broken function-level authorization (BFLA), schema and introspection abuse, rate-limit bypass, and business-logic flaws.
Last reviewed:
/v1/auth/login/v1/users/me/v1/orders/v1/orders/{orderId}/v1/orders/{orderId}query { invoice(id) }/v1/sessions/{sid}File 01 · Definition
What It Is
The work lives at the endpoint. We call every route the way a client would, swap object IDs and roles, and confirm whether the server enforces the authorization the UI only assumes. That covers authentication, broken-object-level authorization (BOLA), broken function-level authorization (BFLA), schema and introspection abuse, rate-limit bypass, and the business-logic flaws no scanner has a signature for.
Because BOLA turns on which object reference reaches which identity, every finding is proven against a real request and written up as a request-and-response trace your engineers can replay without translation.
Reports map to PCI DSS, SOC 2, ISO 27001, HIPAA, and CMMC where the API falls in scope, with severity, remediation, and business impact called out per finding.
Authorization is the single most-broken control in modern APIs, and signature-based scanners cannot see it. A single BOLA on a customer endpoint is a reportable breach, which is why every route has to be tested in context before an attacker enumerates it for you.
File 02 · Threat Model
Why Companies Need This
- 01 You ship a public or partner-facing API. Auditors and large customers expect evidence of manual API testing.
- 02 You operate GraphQL. Schema exposure, query depth, and aliasing abuse need a tester who has broken GraphQL before.
- 03 Your mobile app talks to a backend API. Mobile clients are often the only consumer, and security teams forget the API is testable on its own.
- 04 You hold customer data behind authorization checks. Authorization is the single most-broken control in modern APIs.
File 03 · Deliverables
What You Get
Detailed technical report
CVSS scoring, attack narratives, and proof-of-concept evidence
Executive summary
Findings translated into business risk, not CVSS noise.
Remediation guidance
Prioritized, actionable fixes, not just a list of CVEs
Real-time comms
Dedicated Slack channel for the engagement.
Compliance documentation
Mapped to SOC 2, PCI DSS, HIPAA, ISO 27001, and CMMC
File 04 · Methodology
Our Process
Schema & Surface Mapping
Endpoint discovery, OpenAPI or GraphQL schema review, introspection abuse, role and trust-boundary mapping.
Authentication & Session
JWT analysis, OAuth flows, API-key handling, token replay and refresh abuse, MFA bypass paths.
Authorization (BOLA / BFLA)
Object-level and function-level authorization testing at every endpoint, tenant-isolation checks, mass-assignment and parameter-pollution abuse.
Business-Logic & Abuse-of-Feature
Workflow tampering, race conditions, rate-limit bypass, monetary logic abuse, GraphQL batching and depth attacks.
Reporting & Retest
Attack-path narratives mapped to OWASP API Top 10, CVSS, and compliance controls. Verification retest included.
File 05 · Intel Brief
Frequently Asked Questions
Q1 Do you cover both REST and GraphQL?
Yes. Most API engagements include both if the product exposes both. GraphQL-specific tests like introspection abuse, aliasing, and depth attacks are run when applicable.
Q2 Can you test internal-only APIs?
Yes. Internal APIs are tested via VPN, jump host, or by deploying a tester credential into your environment, depending on scope.
Q3 How is this different from a web app pentest?
API pentests focus on the machine interface, not the rendered UI. We test every endpoint as an attacker would call it directly, including endpoints the UI never invokes.
Talk to an Operator
The Surface Is Already Exposed. Test It First.
The operator who runs your engagement is on the scoping call. Bring your collection or schema and we will tell you where the authorization gaps are likely to be.
Related
Where API testing connects
The clients that consume the API, the cloud it runs on, and the audits that ask for the evidence.
Web application penetration testing
The front end that drives most of your API traffic.
Cloud penetration testing
The IAM and service layer your APIs authenticate against.
Mobile app penetration testing
Mobile clients hit the same APIs from a less-trusted device.
PCI DSS penetration testing
Evidence for payment and Open Banking API scope.
Technology & SaaS security
How SaaS teams scope API testing for enterprise reviews.