API Penetration Testing
Manual testing of REST, GraphQL, and gRPC APIs against the OWASP API Security Top 10, with systematic per-endpoint, per-role authorization testing.
Selva Ops S.R.L.
APIs concentrate the highest-impact vulnerability class in modern applications: broken authorization. A scanner can find a missing header; it cannot know that user A should not be able to read user B’s invoices. That determination — object by object, endpoint by endpoint, role by role — is the core of this assessment, and it is manual work by design.
What gets tested
Aligned with the OWASP API Security Top 10:
- Object-level authorization (BOLA/IDOR) — the single most common critical API finding: predictable or enumerable identifiers combined with missing ownership checks.
- Function-level authorization — admin and internal endpoints reachable by lower-privileged tokens.
- Object property issues — mass assignment, excessive data exposure in responses.
- Authentication — token issuance and validation, JWT algorithm and claim handling, API key management, session fixation across token refresh.
- Resource consumption — missing rate limits, pagination abuse, expensive operations exposed unauthenticated.
- Business flows — abuse of legitimate sequences: skipping payment steps, replaying webhooks, racing concurrent requests.
- SSRF and integration points — URL parameters that make the server fetch attacker-controlled resources.
- Protocol specifics — GraphQL introspection and resolver authorization; gRPC reflection and metadata handling; webhook signature validation.
How it runs
You provide the spec (OpenAPI, Postman, or GraphQL schema) and credentials per role and tenant. Every endpoint is exercised with each identity, and the report includes the authorization matrix — so you can see coverage, not just findings. Mobile and single-page-app backends are the same work; if the API serves an LLM feature, see LLM/AI penetration testing for the additional attack surface.
What you receive
- A report with reproduction steps, evidence, and severity ratings for every finding
- An endpoint-by-endpoint authorization matrix showing what was tested
- Remediation guidance written for backend engineers
- Retest of fixed findings and an updated report
- An attestation letter suitable for customers and auditors
Standards and references
Compliance context
FAQ
- What do you need from us to test an API?
- An OpenAPI/Swagger spec or Postman collection if one exists, test credentials for each role or tenant, and a target environment. Without a spec, endpoint discovery is part of the engagement and is scoped accordingly.
- Can you test GraphQL?
- Yes. GraphQL gets specific attention: introspection exposure, field-level authorization, batching and aliasing abuse, and query-depth/complexity limits.