API Security Testing for REST & GraphQL
For teams shipping REST and GraphQL APIs, this is a manual-led penetration test focused on the flaws automated scanners miss: object- and function-level authorization, business-logic abuse, and token handling. We test the way a real attacker with a valid low-privilege token does — enumerating objects, forging identities, and chaining flows — then hand you reproducible evidence and fixes mapped to OWASP API Security Top 10 (2023).
What we test
Broken Object Level Authorization (BOLA/IDOR — API1:2023)
We swap object IDs, UUIDs, and nested resource references across two accounts to prove one tenant can read or mutate another tenant's records.
Broken Authentication (API2:2023)
We attack login, token issuance and refresh: credential stuffing tolerance, weak JWT (alg:none, HS256/RS256 confusion, unverified signatures), missing token expiry/revocation and OTP/reset flow bypass.
Broken Object Property Level Authorization / Mass Assignment (API3:2023)
We inject unexpected fields (role, isAdmin, balance, tenant_id) into write requests and check for excessive data exposure of properties the client should never receive.
Unrestricted Resource Consumption (API4:2023)
We probe missing or bypassable rate limits, unbounded pagination/page-size, and expensive queries that enable application-layer DoS and cost amplification.
Broken Function Level Authorization (API5:2023)
We call admin and privileged endpoints, forbidden HTTP verbs, and hidden methods with a normal user token to expose vertical privilege escalation.
Unrestricted Access to Sensitive Business Flows (API6:2023)
We abuse workflows — checkout, referral, coupon, signup, booking — for automation and business-logic exploitation such as race conditions and negative-quantity manipulation.
Server-Side Request Forgery (API7:2023)
We test URL/webhook/import parameters for SSRF into cloud metadata (169.254.169.254), internal services and DNS-rebinding, including blind/out-of-band variants.
GraphQL-specific abuse
Introspection exposure, deeply nested query depth attacks, alias/field batching to bypass rate limits, and injection through resolver arguments.
Methodology
- 1
Scoping & authorization
We agree targets, environments, test accounts (at least two roles/tenants) and rules of engagement in writing, and confirm you own or are authorized to test the API before any traffic is sent.
- 2
API inventory & recon (API9)
Per WSTG we enumerate endpoints from OpenAPI/Swagger, GraphQL introspection, mobile/SPA traffic and traffic capture, mapping versions, shadow and deprecated endpoints.
- 3
Authentication & session analysis
We inspect the OAuth2/OIDC flows, JWT structure and signing, token lifetime, refresh and logout, following WSTG-ATHN/WSTG-SESS checks.
- 4
Authorization & business-logic testing
The core manual phase: BOLA/BFLA matrices across roles and tenants (WSTG-ATHZ), mass-assignment, and abuse of sensitive flows with two live accounts.
- 5
Injection, misconfiguration & consumption
We test injection (SQL/NoSQL/command), security misconfiguration (CORS, verbose errors, headers), rate limiting and unsafe consumption of third-party APIs.
- 6
Reporting, retest & debrief
Each finding ships with request/response evidence, CVSS rating, and remediation; a free retest verifies fixes, followed by an engineer debrief.
Standards & references
What you get
- Technical report — Per-finding write-up with reproduction steps, raw request/response, CVSS score and mapped OWASP API/WSTG reference.
- Executive summary — One-page risk narrative for management and auditors, with an overall posture rating and prioritized remediation roadmap.
- Remediation guidance — Concrete, framework-aware fixes per issue — authorization checks, schema constraints, token hardening — not generic advice.
- Free retest & attestation — We re-verify remediated findings and issue a letter of attestation suitable for customers, partners and compliance evidence.
FAQ
What do we need to provide before the test starts?+
A staging or production-like environment, API documentation (OpenAPI/Swagger or GraphQL schema if available), and at least two test accounts per role/tenant so we can prove authorization flaws. For authenticated tests we need working credentials or tokens and any IP allowlisting handled in advance.
How long does an API pentest take?+
A typical REST or GraphQL API of 30–80 endpoints takes 5–10 working days including reporting. The main drivers are endpoint count, number of roles/tenants, and business-flow complexity. You receive a fixed timeline and price after a short scoping call.
Will testing break our production or leak data?+
We default to non-destructive testing and coordinate any potentially disruptive checks (rate-limit, DoS-class) with you in a maintenance window. Prefer a staging environment; if we test production, we use marked test data and avoid mutating real customer records.
Is a free retest included?+
Yes. Once your team fixes the findings, we re-verify them at no extra cost within the agreed window and update the report status, so you have proof the issues are genuinely closed.
Is this legal, and how is authorization handled?+
Testing is only performed under a signed authorization and scope agreement confirming you own or control the target. This makes the engagement lawful, defines exactly which assets are in scope, and protects both parties. We follow a strict rules-of-engagement document throughout.