Published · By the Aesparrow Security Research Team
Short answer
API penetration testing is a manual security test of an application programming interface — REST, GraphQL or SOAP — that tries to break authentication, authorisation, input handling and business logic the way an attacker would. It is aligned to the OWASP API Security Top 10, where broken object-level authorisation (BOLA) is the leading risk.
Why is API security important?
APIs expose business logic and data directly to clients and partners. A single authorisation flaw can let an attacker enumerate every customer record. Because APIs are often undocumented or change quickly, they are frequently missed by traditional web scanning.
API penetration testing checklist
- Inventory: all endpoints, versions and shadow or zombie APIs.
- Authentication: token handling, JWT validation, key exposure and brute-force limits.
- Object-level authorisation: BOLA/IDOR across every object ID.
- Function-level authorisation: admin functions reachable by normal users.
- Property-level authorisation: mass assignment and excessive data exposure.
- Resource consumption: rate limiting, pagination and payload size.
- Injection: SQL, NoSQL and command injection in parameters.
- SSRF: URL parameters that reach internal services.
- Business flows: abuse of sensitive workflows.
- GraphQL specifics: introspection, query depth and batching abuse.
How to conduct API penetration testing
- 1Collect documentationGather OpenAPI/Swagger specs, Postman collections and test accounts for each role.
- 2Map the attack surfaceEnumerate endpoints, methods, parameters and data objects.
- 3Test authentication and authorisationSwap tokens and object IDs between users and roles.
- 4Test input handling and logicFuzz parameters and abuse business workflows.
- 5Report and re-testDeliver reproducible findings with fixes, then verify remediation.
FAQ
Frequently Asked Questions
Clear answers about what we do — and what we don’t. If you have any other questions, feel free to reach out to our team.
How much does API penetration testing cost?
It depends mainly on the number and complexity of endpoints and roles. We quote a fixed fee after reviewing your API specification.