New · Release 2026.04, Multi-tenant audit exports & SLA dashboards now liveSee changelog →
API security
API penetration testing for REST, GraphQL & microservices
Test REST and GraphQL surfaces, auth boundaries, and rate limits with evidence suitable for DevSecOps teams.
Product illustration · sample data
Security & VAPT
A+ score
EngagementHTTP LabReport PDF
A+
Last scan · 2 hours ago
Critical vulnerabilities0
High severity2
Manual + imported4
Engagement reportReady
Product proof
Already live in the product
Infronest module
This engagement can align with shipped product capabilities in your tenant workspace.
Protected app route: /vapt-integrations
Platform
Included in the Infronest workspace
These capabilities ship in the product today—consulting adds human validation and attestation where required.
CI & integrations
Capabilities
What you get
Delivered with AI-assisted engineering and human review on architecture, security, and production readiness.
API security scan type in platform
Schema-aware fuzzing concepts
CI integrations and webhooks
Broken object level authorization checks
Export for SIEM or ticketing
Workflow
What teams can do here
Step 1
Import API spec
Step 2
Map auth roles
Step 3
Execute test suite
Step 4
Track fixes in Git
How it works
How it works
01
Discover the surface
Import an OpenAPI/Swagger spec or let the discovery scanner enumerate common REST and GraphQL paths. Knowing the real endpoint list keeps testing scoped and thorough.
02
Map the auth roles
Provide sessions for the roles you want compared — for example an admin and a standard user — so authorisation boundaries can be tested rather than assumed.
03
Run the API and authz checks
The API scanner looks for unauthenticated access to sensitive data (CWE-306), IDOR/BOLA (CWE-639), missing rate limiting (CWE-770) and unsafe methods (CWE-650); the authz-matrix scanner replays requests across roles to catch BOLA and broken function-level authorisation (BFLA). GraphQL and JWT/OAuth scanners cover those surfaces.
04
Verify and report
High-impact findings are confirmed by hand, scored with CVSS 3.1, and exported in one report. Results can also feed CI via the integrations hub.
Example
A worked example
A typical scope: a B2B SaaS with 85 REST endpoints and a GraphQL gateway hands over its OpenAPI spec plus two tokens — tenant admin and basic member. The authz-matrix replay finds GET /api/v2/invoices/{id} serving another tenant’s invoice to the member token, the API scanner flags an unauthenticated /api/export returning PII, and the login endpoint shows no rate limiting. An analyst reproduces the cross-tenant read, attaches the captured request as evidence and scores it high. Once an ownership check and throttling ship, the suite re-runs and the report shows all three findings closed.
FAQ
Frequently asked questions
Do you test REST and GraphQL, or only REST?
Both. There is a dedicated REST API scanner and a separate GraphQL scanner, alongside JWT and OAuth checks for token-based auth. The right combination is chosen from your endpoint inventory.
What are BOLA and BFLA, and do you check for them?
BOLA (Broken Object Level Authorization) is when a user can read or change another user’s object by changing an ID; BFLA (Broken Function Level Authorization) is reaching an admin-only function as a normal user. The authz-matrix scanner replays requests across roles specifically to surface both.
How much does API penetration testing cost?
API engagements in India generally price in the same band as a focused web application penetration test — typically ₹1.5–4 lakh (USD 2,000–5,000) — while combined network + web VAPT for a mid-size environment runs ₹5–15 lakh (USD 6,000–18,000). Infronest engagements start at ₹36,750 per application; pricing context lives on the VAPT hub.
How long does an API security assessment take?
With a spec supplied, a scoped API assessment typically completes in one to two weeks including human verification — industry-typical, not a promise for every scope. Without a spec, discovery adds time; very large endpoint inventories trend toward the one-to-three-week range of a full web test.
Do I need to provide an OpenAPI or Swagger spec?
It helps but is not mandatory. With a spec, coverage is precise; without one, the discovery scanner probes common REST and GraphQL paths. Providing the spec is the fastest way to get complete coverage.
How do you test authorisation differences between roles?
You supply sessions for the roles you care about, and the authz-matrix scanner sends the same requests under each — including an unauthenticated pass — so a 200 where a 403 was expected exposes a vertical or horizontal privilege-escalation gap.
Will the API tests send destructive or bulk-write requests?
Testing stays within the engagement allowlist and favours read and safe-method probing. Anything with write or destructive potential is agreed in scope first — you should always test against a staging environment or with explicit written authorisation for production.
Role-matrix replay across your real endpoints surfaces the cross-tenant reads and unauthenticated exposures that standard scans miss — with evidence attached to every confirmed finding.