Penetration Testing
API Penetration Testing Services and API Security Testing
Our API penetration testing services are manual attacks on your REST, GraphQL or SOAP endpoints that find broken authorisation, weak authentication and data exposure before an attacker does. We test every endpoint against the OWASP API Security Top 10 and, as a PCI SSC-approved QSA company, report the results as PCI DSS and ISO 27001 evidence.
Prefer to talk? Call +44 161 523 5276
- OWASP API Security Top 10
- REST, GraphQL and SOAP
- Retest of remediated findings available
Trusted by banks, payment providers and global brands
On this page
- What's included in an API penetration test
- API security testing against the OWASP API Top 10
- API penetration test at a glance
- How does API penetration testing differ for REST, GraphQL and SOAP?
- SOAP and web services penetration testing
- Which tools are used for API penetration testing?
- How much does an API penetration test cost?
- How is an API penetration test carried out?
- Why choose Sovereign Secure for API penetration testing services?
- Frequently asked questions
Overview
What is API penetration testing?
The short answer
API penetration testing is a manual security test of the REST, GraphQL or SOAP endpoints behind your apps and integrations. A tester calls each endpoint directly as every role and consumer, checking object and function-level authorisation, authentication and tokens, data exposure, rate limits and injection against the OWASP API Security Top 10.
API penetration testing is a focused assessment of the interfaces that move data between your systems, apps and partners. We simulate real attacks against your endpoints to uncover broken authorisation, weak authentication, broken object property level authorisation and injection, without relying on the front end to reach them.
APIs fail differently to web applications. Object-level authorisation (the API form of insecure direct object references (IDOR)), function-level authorisation, token handling and rate limiting are where most serious issues live, so we test each endpoint directly against every role and consumer you provide.
API security testing is the wider discipline: it includes automated checks in your build pipeline as well as manual testing. An API penetration test is the manual, adversarial part, where a tester chains issues together and proves impact. It is also the part PCI DSS and ISO 27001 auditors ask to see. Our API security checklist lists the controls your developers can check between tests.
The report is structured as evidence for PCI DSS penetration testing under Requirement 11.4 and for ISO 27001:2022 Annex A 8.8 and 8.29. It pairs naturally with a web application penetration test when the API sits behind a user-facing app, or a mobile app penetration test when it serves iOS and Android clients. New to testing? Our guides to what penetration testing is and the types of penetration testing show where this test fits.
What's included
What's included in an API penetration test
Every API engagement covers the following as standard.
- 01
OWASP API Security Top 10 coverage
Testing across the OWASP API Security Top 10, including broken object level authorisation and broken function level authorisation.
- 02
Authentication and token testing
JWT, OAuth and API key handling checked for the flaws that let an attacker impersonate a user or service.
- 03
Authorisation testing per role
Every endpoint tested against each role and tenant you provide, to find object- and function-level access failures.
- 04
Input and injection testing
Endpoints probed for injection and mass assignment, and for the parsing flaws that come with complex payloads.
- 05
Rate limiting and abuse checks
Testing for missing throttling, enumeration and resource-exhaustion issues on sensitive endpoints.
- 06
Schema and documentation review
We work from your OpenAPI, GraphQL schema or Postman collection to make sure every documented and hidden endpoint is covered.
- 07
Manual verification
Each finding is confirmed by hand with clear reproduction steps.
- 08
Retest
A retest of remediated findings, scoped in your fixed-price proposal, with the report updated to show them closed.
What we test for
API security testing against the OWASP API Top 10
The categories below map to the OWASP API Security Top 10 (2023).
Broken object level authorisation
Endpoints that accept an object identifier without properly checking whether the caller is allowed to see it.
- Identifier tampering to reach other records
- Missing object-level access checks
- Insecure direct object references
- Multi-tenant boundary bypass
- GraphQL object-level authorisation gaps
Broken authentication
Flaws in login, token handling and session management that let an attacker take over accounts or services.
- Weak or missing token validation
- JWT and OAuth implementation issues
- Token reuse and replay
- Brute-force exposure on auth endpoints
- Insecure key or secret handling
Broken object property level authorisation (API3)
Responses that over-share object properties, or requests that can set properties the caller should not control (formerly excessive data exposure and mass assignment).
- Over-exposed fields in responses
- Leaked internal identifiers and tokens
- Missing field filtering or allow-listing
- Sensitive data in verbose errors
- Mass assignment of protected fields
Broken function level authorisation
Administrative or privileged functions reachable by users who should not be able to call them.
- Access to admin functions as a low-privilege user
- Hidden or undocumented methods
- HTTP verb tampering
- Missing role checks on state-changing calls
- Privilege escalation between consumer types
Unrestricted resource consumption (API4)
APIs with no protection against automation, allowing brute force, enumeration and scraping.
- Missing or weak rate limiting
- No lockout after repeated failures
- Abuse of password reset or auth endpoints
- Unrestricted enumeration of users or data
- Resource-exhaustion through large queries
Business flows, SSRF and misconfiguration (API6 to API8)
Sensitive business flows that can be automated at scale, server-side requests an attacker can steer, and insecure configuration, alongside the injection testing every API still needs.
- Abuse of sensitive business flows at scale
- Server-side request forgery via API parameters
- CORS, TLS, error handling and exposed documentation
- SQL, NoSQL and command injection
- GraphQL query abuse
- XML and payload parsing flaws
Inventory and third-party consumption (API9, API10)
Forgotten API versions and environments that widen the attack surface, and data from third-party APIs trusted without validation.
- Old API versions and undocumented endpoints
- Debug or development endpoints in production
- Shadow and test environments
- Unvalidated data from third-party APIs
API penetration test at a glance
| Aspect | Typical API penetration test |
|---|---|
| Scope | REST, GraphQL and SOAP endpoints, every role, tenant and consumer type you provide, and any undocumented routes found during discovery |
| Approach | Grey box, working from your OpenAPI file, GraphQL schema, WSDL or Postman collection, with test tokens for each role |
| Typical duration | A few days for a small API; longer for a large or multi-consumer API. We confirm the timeline at scoping |
| Standards | OWASP API Security Top 10 (2023) and OWASP ASVS, reported for PCI DSS 11.4 and ISO 27001 Annex A 8.8 and 8.29 |
| Deliverables | Executive summary, findings with example requests and reproduction steps, CVSS ratings and remediation advice for each endpoint |
How does API penetration testing differ for REST, GraphQL and SOAP?
The authorisation questions are the same for every API: can one user reach another user’s data, or call a function meant for someone else? What changes is where those flaws hide, so the tester adapts the method to the API style.
| API style | How it works | Where testing focuses |
|---|---|---|
| REST | Resources addressed by URL and HTTP method, usually exchanging JSON and documented in an OpenAPI file | Object identifiers in paths and parameters, HTTP verb tampering, mass assignment of protected fields and rate limits on sensitive endpoints |
| GraphQL | A single endpoint where the client writes its own queries against a published schema | Introspection left enabled, authorisation in each resolver and field, deeply nested or batched queries, and aliases used to get round rate limits |
| SOAP | XML messages defined by a WSDL, often protected with WS-Security | XML external entities (XXE) and injection, signature and WS-Security handling, SOAP action spoofing and trust between internal services |
Most estates mix styles, for example a GraphQL API for the mobile app alongside older SOAP services for partners, and one engagement can cover all of them.
If the API sits behind a mobile app, our mobile app security testing checklist covers the on-device side of the same system.
SOAP and web services penetration testing
Web services penetration testing covers the SOAP and XML interfaces that still carry payments, banking and partner integrations, alongside REST and GraphQL. We map every operation from the WSDL, then test each one for XML injection and XML external entity (XXE) attacks, WS-Security and signature handling, SOAP action spoofing and the same object-level authorisation flaws found in modern APIs.
Older services are often reachable only through a partner gateway or service bus, so they can trust the caller more than they should. Testing shows what happens when that trust is abused, and where a web service handles card data the report stands as PCI DSS 11.4 evidence like any other API test.
Which tools are used for API penetration testing?
For API pen testing, testers commonly use an intercepting proxy such as Burp Suite or ZAP, request collections in Postman or a similar client, and schema-driven tools that turn an OpenAPI file or a GraphQL introspection result into a list of endpoints to test. Scripts then replay each request as different users to look for broken object level authorisation.
Tools speed up discovery and repeat known checks. The serious API findings, such as one tenant reading another tenant’s records, come from a tester comparing responses across roles by hand.
How much does an API penetration test cost?
API tests are priced in tester-days, and APIs rarely carry a published price because their size varies so much from one client to the next. These drivers set the number of days:
| Cost driver | Why it changes the price |
|---|---|
| Endpoints and operations | Each endpoint is tested against each role, so the count drives most of the effort |
| Roles, tenants and consumer types | More roles and tenants mean more cross-account authorisation checks |
| Authentication methods | OAuth flows, JWTs, API keys and mutual TLS each need their own tests |
| API style | GraphQL and SOAP add testing for query abuse, introspection and XML parsing |
| Documentation quality | A complete OpenAPI file, schema or collection saves discovery time; missing documentation adds days |
Our penetration testing cost guide explains how tester-days set the price, and the API penetration testing quote form collects what we need to scope your test.
How it works
How is an API penetration test carried out?
- 1
Scoping
We agree the endpoints, roles, consumers and environment, and fix the price before any testing starts. Our checklist on how to prepare for a penetration test covers your side.
- 2
Discovery
We map every endpoint from your schema or collection, plus any hidden or undocumented routes we find.
- 3
Testing
Manual testing of authorisation, authentication, data exposure and injection across each role, backed by professional tooling.
- 4
Reporting
An executive summary and technical report with reproduction steps, CVSS ratings and remediation advice.
- 5
Debrief
A walkthrough call to talk through the findings, the risk and the fixes with your engineers.
- 6
Retest
Once fixes are in place, we retest and reissue the report showing findings closed.
Every test follows the five stages of penetration testing: planning and reconnaissance, scanning, gaining access, maintaining access, and analysis and reporting.
Why Sovereign Secure
Why choose Sovereign Secure for API penetration testing services?
Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies.
Read client testimonials →- Findings written with your QSA audit in mind. We are a QSA company, so the evidence lines up with what assessors ask for.
- Every endpoint tested by hand against each role, not just scanned from a schema.
- Works from your OpenAPI, GraphQL or Postman definitions for full coverage.
- Fixed scope and price, with any retest and its window agreed in your proposal.
FAQ
Frequently asked questions
Can't find your answer? Call us on +44 161 523 5276 or send us a message.
How is an API test different from a web application test?
A web application test attacks the app through its front end. An API test targets the endpoints directly, focusing on object- and function-level authorisation, token handling and data exposure, which are where APIs most often fail. If the API sits behind a user-facing app, we usually recommend testing both.
What do you need from us to test an API?
API documentation such as an OpenAPI or Swagger file, a GraphQL schema or a Postman collection, test credentials or tokens for each role and consumer, and a base URL for a test environment. The more complete the schema, the more thorough the coverage.
Do you test GraphQL and SOAP as well as REST?
Yes. We test REST, GraphQL and SOAP APIs, and adapt the methodology to each, including GraphQL-specific issues such as introspection abuse, nested query attacks and object-level authorisation.
Does an API test count towards PCI DSS 11.4?
Yes. APIs that store, process or transmit cardholder data, or that sit within your defined scope, fall under Requirement 11.4. As a QSA company, we write the report so it serves as evidence for your assessment. Our PCI penetration testing page explains the full requirement.
How long does an API pentest take?
It depends on the number of endpoints and roles. A small API is typically a few days; a large or multi-consumer API takes longer. We confirm the timeline in the fixed-price proposal.
What are the main types of API testing?
There are three broad types: functional testing checks the API does what it should, performance testing checks how it behaves under load, and security testing checks it cannot be abused. An API penetration test is the manual, adversarial part of security testing, alongside any automated checks in your build pipeline.
How should we prepare for an API security test?
Use this short checklist: an up-to-date OpenAPI file, GraphQL schema or Postman collection; test accounts or tokens for every role and consumer type, including two users in the same role so we can test cross-account access; a non-production environment with realistic data; any rate limits or web application firewall rules you want relaxed for our IP addresses; and a technical contact for the testing window. Our guide on how to prepare for a penetration test covers the rest.
Can you test in production without breaking anything?
We prefer a test environment. Where we must test in production, we agree strict rules of engagement, avoid destructive payloads and denial-of-service techniques, and define testing windows in advance.
Last reviewed October 2026 by the Sovereign Secure assessment team.
Related services
- Web application testingWeb application penetration testing in the UK: manual OWASP Top 10, access-control and business logic testing by a PCI QSA company. Get a quote.
- Mobile app testingMobile penetration testing for iOS and Android apps to OWASP MASVS: on-device storage, traffic, authentication and the APIs behind the app. Get a quote.
- PCI DSS penetration testingPCI compliance penetration testing to PCI DSS Requirement 11.4 by a QSA company: internal, external, application and segmentation pen tests with ROC-ready reports.
- Penetration testing costPen test cost in the UK for 2026: published day rates and penetration testing price ranges by test type, what drives cost, and how to get a fixed quote.
- Penetration testing quoteScope your test types and asset counts and get a fixed-price penetration testing proposal.
Free consultation
Talk to an assessor
We aim to reply within one working day, and send a fixed quote once your scope is confirmed.
- PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessors
- IASME-licensed Cyber Essentials certification body
- Clients across the UK, US, Europe, Middle East and Asia since 2012
“The Cyber Security Services were delivered on time and price was competitive.”
Call +44 161 523 5276
Email [email protected]