API Penetration Testing
APIs power your product, your integrations, and increasingly your AI features — and they're now the primary target of automated attacks. StandardPentest tests REST, GraphQL, and gRPC APIs against the OWASP API Security Top 10 with deep authorization, rate-limiting, and business-logic coverage. Audit-ready results in 24 hours.
What We Test
- •Broken object-level authorization (BOLA) and broken function-level authorization (BFLA)
- •Broken authentication including weak token issuance, refresh token abuse, and OAuth misconfigurations
- •Excessive data exposure and unrestricted resource consumption
- •Injection across query parameters, headers, body, and GraphQL queries
- •Mass assignment and improper input validation
- •Server-side request forgery via API redirects and webhooks
- •Improper inventory management (shadow APIs, unversioned endpoints, deprecated routes)
- •Rate limiting, abuse, and resource exhaustion
- •GraphQL-specific risks (introspection exposure, query depth/complexity, batching abuse)
Our Methodology
We start by ingesting your OpenAPI, GraphQL schema, or Postman collection — or by discovering endpoints from traffic if no spec exists. From there we run a four-phase workflow: schema validation, authentication and authorization testing across roles, business-logic abuse, and resource-consumption testing. Every finding is verified manually before it appears in the report.
What You Get
- •An OpenAPI-aware findings report mapped to OWASP API Top 10 (2023)
- •Per-endpoint risk ratings and reproduction steps using curl or your spec
- •GraphQL-specific findings including resolver-level recommendations where applicable
- •An attestation letter for compliance and customer security reviews
- •A free retest of remediated findings within 90 days
Frequently Asked Questions
Do you support GraphQL and gRPC?
Yes. GraphQL is fully supported including introspection-based testing, depth and complexity analysis, and batching abuse. gRPC is supported when a .proto file or reflection endpoint is available.
What about internal APIs?
Internal and partner APIs are tested the same way external ones are, typically via a VPN or jump host. We can also test from inside your environment using a lightweight runner.
How do you handle rate limits during testing?
We respect declared rate limits and coordinate with your team on test windows. Our default is rate-aware testing that distinguishes real findings from artifacts of throttling.
Can you test AI/LLM-backed APIs?
Yes. We test for prompt injection, output handling, model denial of service, training data leakage in responses, and authorization issues around tool use and function calling.
Send us your OpenAPI spec or GraphQL schema and we'll scope your test the same day.