Your APIs carry your data. We prove who can actually reach it.

BOLA (Broken Object Level Authorisation, also called IDOR) is the most common serious API flaw: the server returns a record without checking that it belongs to the user asking. In practice it means changing an ID in a request, say from your account number to the next one, and receiving someone else’s data. Because IDs are often sequential, a single flawed endpoint can expose your entire customer base, which is why it sits at number one in the OWASP API Security Top 10 and why we test it exhaustively.

A scanner cannot judge whether a request should be allowed, because the request itself is valid. When an ordinary user reads an admin record, the API returns a normal 200 OK response; nothing looks broken to a tool. Deciding that the response should never have reached that user requires understanding your roles and your business, which is human work. Scanners help with coverage and known issues; they do not find the authorisation flaws that cause the biggest API breaches.

No, though they overlap. A web pentest looks at the application a user sees in the browser; an API pentest looks at the machine-to-machine interface behind it, the same interface your mobile app, partners and microservices call directly. APIs concentrate authorisation and business-logic risk, and they often expose functions the web front end never shows. If your product is API-first or has a mobile app, the API is frequently the more important target. Many engagements cover both; we will tell you in the introductory meeting which your situation needs. See also our web application pentesting service.

We test all four. REST is the most common, but GraphQL, gRPC and SOAP each have their own risks, GraphQL schema introspection and query abuse, gRPC and SOAP message handling, and we test them on their own terms rather than forcing a REST checklist onto them. Tell us what you run and we scope accordingly.

A focused API with a clear role model typically takes one to two weeks of active testing; a large surface with many roles, multiple API styles or complex business flows runs two to three weeks. Good documentation and test accounts shorten it. We confirm the timeline in the proposal, delivered within 48 hours of the first call.

Price follows scope: the number of endpoints, the number of roles, the API styles involved and the complexity of your business logic. We quote a fixed price with no hidden fees and no obligation to renew. A focused single-API assessment sits at the bottom of the range; large multi-role, multi-style surfaces scale from there. The retest that confirms your fixes is always included.

Ideally API documentation (OpenAPI/Swagger, a GraphQL schema or a Postman collection), two test accounts per role so we can test authorisation across boundaries, and a staging environment or a production URL in scope. If documentation is incomplete we still proceed; discovering undocumented endpoints is part of the value. One technical contact for questions keeps the engagement moving.

The senior specialist you meet on the first call runs it end to end. Our team holds OSCP, OSWE and OSEP credentials, works by hand against the OWASP API Security Top 10, and we are NASA Bug Bounty verified contributors with published API findings. The same person scopes, executes and retests. They are your point of contact throughout.