Core Service
FILE · OIU-SVC

APIs Are the Modern Attack Surface.

BOLA is the new SQLi. Broken object-level authorization is the number-one risk in the OWASP API Security Top 10, and signature-based scanners do not catch it. We test REST and GraphQL the way attackers probe them: one object reference at a time.

Definition API penetration testing is manual adversarial assessment of REST and GraphQL APIs covering authentication, broken-object-level authorization (BOLA), broken function-level authorization (BFLA), schema and introspection abuse, rate-limit bypass, and business-logic flaws.

Last reviewed:

File 01 · Definition

What It Is

The work lives at the endpoint. We call every route the way a client would, swap object IDs and roles, and confirm whether the server enforces the authorization the UI only assumes. That covers authentication, broken-object-level authorization (BOLA), broken function-level authorization (BFLA), schema and introspection abuse, rate-limit bypass, and the business-logic flaws no scanner has a signature for.

Because BOLA turns on which object reference reaches which identity, every finding is proven against a real request and written up as a request-and-response trace your engineers can replay without translation.

Reports map to PCI DSS, SOC 2, ISO 27001, HIPAA, and CMMC where the API falls in scope, with severity, remediation, and business impact called out per finding.

Authorization is the single most-broken control in modern APIs, and signature-based scanners cannot see it. A single BOLA on a customer endpoint is a reportable breach, which is why every route has to be tested in context before an attacker enumerates it for you.

File 02 · Threat Model

Why Companies Need This

  • 01 You ship a public or partner-facing API. Auditors and large customers expect evidence of manual API testing.
  • 02 You operate GraphQL. Schema exposure, query depth, and aliasing abuse need a tester who has broken GraphQL before.
  • 03 Your mobile app talks to a backend API. Mobile clients are often the only consumer, and security teams forget the API is testable on its own.
  • 04 You hold customer data behind authorization checks. Authorization is the single most-broken control in modern APIs.

File 03 · Deliverables

What You Get

Unlimited remediation validation included. No time cap, no per-finding charge. How it works

Detailed technical report

CVSS scoring, attack narratives, and proof-of-concept evidence

Executive summary

Findings translated into business risk, not CVSS noise.

Remediation guidance

Prioritized, actionable fixes, not just a list of CVEs

Real-time comms

Dedicated Slack channel for the engagement.

Compliance documentation

Mapped to SOC 2, PCI DSS, HIPAA, ISO 27001, and CMMC

File 04 · Methodology

Our Process

01 SCHEMA

Schema & Surface Mapping

Endpoint discovery, OpenAPI or GraphQL schema review, introspection abuse, role and trust-boundary mapping.

02 AUTHENTI

Authentication & Session

JWT analysis, OAuth flows, API-key handling, token replay and refresh abuse, MFA bypass paths.

03 AUTHORIZ

Authorization (BOLA / BFLA)

Object-level and function-level authorization testing at every endpoint, tenant-isolation checks, mass-assignment and parameter-pollution abuse.

04 ABUSE

Business-Logic & Abuse-of-Feature

Workflow tampering, race conditions, rate-limit bypass, monetary logic abuse, GraphQL batching and depth attacks.

05 VALIDATE

Reporting & Retest

Attack-path narratives mapped to OWASP API Top 10, CVSS, and compliance controls. Verification retest included.

File 05 · Intel Brief

Frequently Asked Questions

Q1 Do you cover both REST and GraphQL?

Yes. Most API engagements include both if the product exposes both. GraphQL-specific tests like introspection abuse, aliasing, and depth attacks are run when applicable.

Q2 Can you test internal-only APIs?

Yes. Internal APIs are tested via VPN, jump host, or by deploying a tester credential into your environment, depending on scope.

Q3 How is this different from a web app pentest?

API pentests focus on the machine interface, not the rendered UI. We test every endpoint as an attacker would call it directly, including endpoints the UI never invokes.

Talk to an Operator

The Surface Is Already Exposed. Test It First.

The operator who runs your engagement is on the scoping call. Bring your collection or schema and we will tell you where the authorization gaps are likely to be.