API VAPT: every endpoint, not just the ones your app calls
API VAPT tests your REST or GraphQL API directly: who can call each endpoint, whose data comes back, and what happens when requests are changed, replayed or sent out of order. Tested against the OWASP API Security Top 10 (2023), from ₹79,000 plus GST.
In short
- APIs expose more than the app shows: old versions, admin endpoints and fields the UI never sends.
- Broken object level authorisation (BOLA) is the top API risk and needs manual testing per role.
- Send an OpenAPI spec or Postman collection and tokens for every role; it saves paid testing days.
- An API alone fits a focused test; an app and its API together fit a product test.
The OWASP API Security Top 10 (2023)
| Risk | What we test |
|---|---|
| API1 Broken object level authorisation | Every object ID, as every role, across tenants |
| API2 Broken authentication | Token issue, expiry, refresh, revocation, brute-force limits |
| API3 Broken object property level authorisation | Fields returned that should not be; fields accepted that should not be (mass assignment) |
| API4 Unrestricted resource consumption | Rate limits, page sizes, upload sizes, expensive queries |
| API5 Broken function level authorisation | A member calling admin endpoints |
| API6 Unrestricted access to sensitive business flows | Sign-ups, purchases or invites that can be automated at scale |
| API7 Server-side request forgery | URLs the server fetches on your behalf |
| API8 Security misconfiguration | CORS, verbose errors, debug endpoints, TLS |
| API9 Improper inventory management | Old versions and undocumented endpoints still live |
| API10 Unsafe consumption of APIs | How you trust data from third-party APIs and webhooks |
Why APIs need their own test
The app is one client of your API. Attackers write their own. They call endpoints in a different order, change IDs, add fields the UI never sends and try versions you thought were retired. A test that only follows the app’s traffic misses all of that.
What you receive
- Each finding with the endpoint, method, version, role and token used, and the request and response that prove it.
- A coverage record mapped to the OWASP API Security Top 10.
- Specific fixes, and a retest with an updated report.
Before the test
- Export the OpenAPI spec or a Postman collection, including deprecated versions still running.
- Issue tokens or accounts for every role, in two tenants where tenancy applies.
- Tell us about rate limits and anything that sends real emails, payments or messages.
Our prices
Starting prices for the three packages. Your quote is fixed after a scoping call.
Compare packagesFocused test
One website, app or API. Right for a launch or a first customer review.
Product test
A full SaaS product, where each customer must only see their own data.
Release programme
Two tests a year, for teams that ship often and answer security reviews all year.
Questions buyers ask
What is API VAPT?
A vulnerability assessment and penetration test of an API: checking authentication, authorisation on every object and function, data exposure, rate limits and input handling, by calling the API directly rather than through the app.
What is BOLA?
Broken object level authorisation: the API returns or changes an object, such as an invoice or a user, without checking that the caller is allowed to access it. It is number one in the OWASP API Security Top 10 (2023).
Do you test GraphQL?
Yes. GraphQL adds its own risks: introspection, deeply nested queries, batching that bypasses rate limits, and authorisation checked on the query but not on each field.
What do you need from us?
An OpenAPI specification or Postman collection, tokens or test accounts for every role, two tenants where tenancy applies, and a stable test environment.
Can you test an API without an app?
Yes. A standalone API fits the focused test, from ₹79,000 plus GST. An application and its API together fit the product test, from ₹1,49,000.
Get a fixed quote for your API.
Send the spec, the roles and the deadline. You get scoping questions, then a fixed quote.