API penetration testing
An API penetration test checks whether one user can read or change another user’s records, call functions above their role, or bend the API’s business rules, which a scanner cannot prove on its own. Ghost Protocol tests a REST or GraphQL API together with its web application, logged in as two user roles, with findings mapped to the OWASP API Security Top 10 (2023), a free re-test and a signed attestation letter.
Last reviewed
Tested against the OWASP API Security Top 10 (2023)
All ten entries, each the way our published method tests it. Authenticated authorisation testing (BOLA and BFLA, the first and fifth entries) is performed by the engineer, logged in as both roles, against a written matrix of what each role may reach.
| Entry | How we test it |
|---|---|
| API1:2023 Broken Object Level Authorization | Every request that takes an object identifier is replayed with the other role's identifiers, and what the server does is recorded. A 200 where a 403 belongs is the finding. |
| API2:2023 Broken Authentication | Login, password reset, sessions and tokens: what a reset token is derived from and how long it lives, whether logout revokes on the server, and what a JSON Web Token is verified against, algorithm, signature, audience and expiry included. |
| API3:2023 Broken Object Property Level Authorization | Mass assignment wherever a request body binds to a model, and responses that return fields the caller should never see. |
| API4:2023 Unrestricted Resource Consumption | Pagination limits, expensive filters, GraphQL depth and aliasing, and rate limits on the endpoints that matter, measured by finding where the limit is, not by overloading your infrastructure. |
| API5:2023 Broken Function Level Authorization | An ordinary user reaching an administrative route, including the quiet case where the interface hides a control but the endpoint behind it does not. |
| API6:2023 Unrestricted Access to Sensitive Business Flows | Requests that are legal one at a time and harmful in sequence or quantity: price and quantity tampering, discount and refund paths, steps taken out of order, races on balances and single-use tokens. |
| API7:2023 Server Side Request Forgery | Every place the server fetches a URL you supplied, such as webhooks, imports, document renderers and link previews, aimed at internal ranges and cloud metadata. |
| API8:2023 Security Misconfiguration | CORS that reflects an arbitrary origin with credentials, cookie flags and scope, security headers judged by whether they can be exploited, verbose errors and version disclosure. |
| API9:2023 Improper Inventory Management | Undocumented endpoints, and version drift: an older path that outlived the access-control fix applied to the newer one. |
| API10:2023 Unsafe Consumption of APIs | Where your API takes data from other services: webhook endpoints tested for signature verification and replay, payment webhooks included. |
- OWASP, OWASP API Security Top 10, 2023 edition, read on 24 October 2026.
Three API findings from our example report
The example report (GP-EXAMPLE-2026-001) is written against Northwind Retail, a client that does not exist. The findings are real vulnerability classes, each with its CVSS v3.1 vector printed beside the score.
| Severity | CVSS | Finding |
|---|---|---|
| Critical | 9.8 | GP-NWR-01: Mass assignment on customer registration grants the administrator role. Filed under API3:2023, fixed at the re-test. |
| High | 8.1 | GP-NWR-02: Broken object-level authorisation on order read and update. Filed under API1:2023, fixed at the re-test. |
| Medium | 6.5 | GP-NWR-04: No rate limiting or lockout on authentication and password reset. Filed under API4:2023, still open at the re-test. |
What we need from you
Five things, agreed in writing before anything is touched.
- Written authorisation from the owner of the API, and from any third party whose systems or data it runs on, where their sign-off is needed
- The scope: the API, the web application in front of it, and up to three hostnames
- One test account for each of two user roles, with a note of what each role may reach
- The API's description if you have one: an OpenAPI document, a Postman collection or a GraphQL schema. It helps but is not required; we map the API from the application too, and check any document against what the server really does.
- Production or staging, your choice, and a named contact we can reach within the hour
What you receive
The report arrives in 5 to 7 days. Everything below is inside the fixed price.
Executive report
Every finding rated and explained in plain English, with the evidence that proves it. Every high-severity finding comes with steps your engineers can replay.
Signed attestation letter
Who tested what, when, by which method, and the outcome, for auditors and customers.
Developer findings in JSON and SARIF
The same findings in machine-readable form, for GitHub Advanced Security, SonarQube or your CI pipeline.
A free re-test
Once you have fixed the findings, we test them again and reissue the report and the letter.
30 days of questions
Email the engineer who ran your test for 30 days after delivery.
Scope, and what is not included
One web app plus its API, up to three hostnames and two user roles, one price, held. Authenticated authorization testing (BOLA and BFLA) is performed by the engineer.
Not included
- Mobile apps (iOS and Android)
- Internal corporate networks, including the internal and segmentation testing PCI DSS also asks for
- Denial-of-service testing
- Third-party services you do not control, such as your payment processor or identity provider
- Physical security
Social engineering and red-team engagements are offered as separate engagements, scoped and quoted individually. The fixed-price web and API penetration test does not include them.
If your API serves an AI agent
The agent and the MCP servers it calls can be tested in the same engagement: see AI agent security testing. A larger scope, with more apps, hostnames or roles, is quoted per scope on the pricing page.
Not ready for a test yet? The free website scan reads your public surface in about a minute, with no signup.
Questions about API testing
How much does an API penetration test cost?
An API tested together with its web application is $4,000, fixed: one web app plus its API, up to three hostnames and two user roles, with the report, the signed attestation letter and a free re-test. Larger scopes are quoted; every price is on the pricing page. Companies registered in Sri Lanka have a local rate card.
What is broken object level authorisation (BOLA)?
It is when an API returns or changes a record because the caller asked for its identifier, without checking that the record belongs to the caller. Change an order number in a request and receive someone else's order: that is BOLA, the first entry in the OWASP API Security Top 10 (2023), and finding GP-NWR-02 in our example report.
Do you test GraphQL?
Yes. REST and GraphQL are both in scope. For GraphQL we also test query depth and aliasing, and we use introspection, where it is enabled, to map the schema before checking it against what the server really does.
Do you need our API documentation?
No. An OpenAPI document, a Postman collection or a GraphQL schema helps, and we use it when you have one. We also map the API from the application itself, because the endpoints missing from the documentation are usually the ones worth the most.
Can you test in production?
Yes, or staging; the choice is yours. Staging is safer and production is more accurate. We test non-destructively either way: no data is changed outside the test accounts you designate, and no exploit is run against live customer records.
How is this different from a DAST scan?
A dynamic scan sends known attack patterns and reports what looks wrong. It has no model of who should see which record, so it cannot tell that one customer reading another's invoice is a breach. Our engineer works from a written matrix of what each role may reach. Our scanning engine runs first for breadth, and nothing reaches the report on its output alone.
Will an auditor accept the report for SOC 2 or ISO 27001?
It is written for auditors: a scope statement, the method, severity-ranked findings, remediation, and a signed, dated attestation letter. SOC 2 does not explicitly require a penetration test, and auditors commonly file one as evidence under CC4.1 (SOC 2 penetration testing). ISO 27001:2022 does not mandate one either; auditors file it under control A.8.8, the management of technical vulnerabilities (ISO 27001 penetration testing). Acceptance is your auditor’s decision.
Send us the API you want tested
Email ryan@ghosts.lk or message +94 71 055 5055 on WhatsApp. Ryan replies within 24 hours. Working hours are Monday to Friday, 09:00 to 18:00 Colombo time (UTC+5:30).
Book a pentestThe fixed-price penetration test Book a 15-minute call Buying for a company? Procurement details