API Security Testing for REST and GraphQL
APIs expose your data and your logic to anyone who can reach them. We test authentication, authorization and the attack surface of your APIs, verify every finding with a proof of concept and engineer the fix down to the code.
What the test covers
The assessment looks at how your API behaves under attack:
- Authentication: how users and services prove who they are.
- Authorization: whether one user can reach another user's data.
- The API attack surface: endpoints, parameters and what each one exposes.
- REST and GraphQL interfaces.
- Vulnerability scanning of the API, followed by human verification.
Why a person checks the findings
Scanners find patterns. Authorization flaws depend on context, for example which user may see which record. Our specialists test those cases by hand and confirm each one with a proof of concept.
What you receive
A written report with the evidence behind each finding, a CVSS severity and fix guidance. From the Growth plan, which includes one application or API in scope, we engineer the fix down to the affected code and retest it.
Evidence from audited software
The public ledger lists 387+ audited apps and 262+ critical findings. These full reports show how we document what we find:
- SAP: A Chinese push SDK in a field-service app, and Firebase keys hardcoded across five apps.
- Nike: Development and production push credentials hardcoded in the shipped build.
- Strava: A hardcoded key and a security configuration that protects nothing.
- Revolut: The largest third-party SDK in the series and what it sends to a US company.
Every other investigation is in the full evidence ledger.
Start with the Domain Security Test
The Domain Security Test examines one domain from the outside: read-only, from a European IP address, with no login and no payloads. A researcher reviews your request and replies within one business day.
Plans and prices are on the Access page, the agents behind every review on The Squad page.
Plans and prices are on Access, the agents behind every review on The Squad and the frameworks we measure against on Standards.
Put your domain to the test. Submit it for an initial external security assessment of your publicly accessible attack surface.
No login, no payloads and no changes to your systems.
A researcher reviews your request before testing begins and responds within one business day. You'll receive a short written report covering our findings, likely attack scenarios, potential financial impact and recommended next steps, alongside an exportable security intelligence graph connecting the findings.
Questions about API security testing
Do you test REST and GraphQL?
Yes, both.
Is this an API security audit or a penetration test?
The work combines both: an assessment of the whole interface and hands-on attack tests of the weak spots.
Can you fix the problems you find?
Yes. We engineer the fix down to the code and retest it.
What does it cost?
Plans and prices are on the Access page.
Related pages
More on the pages App Security Audit, GDPR App Audit, NIS2 for Software Vendors, Tracker & SDK Check, AI App Privacy Audit, Outsourced SOC, Compliance Automation, Domain Security Test, Penetration Testing, Cloud Security Assessment and Secure Code Review.
