Overview
In the US, APIs increasingly carry regulated data: customer financial records under the FTC Safeguards Rule, patient information covered by HIPAA, and card flows inside PCI DSS scope. That raises the cost of a single missing authorization check. We test each endpoint with tokens for every role, note which regulated data a finding exposes, and tie scoping to how your partners and mobile clients call the service.
An API exposes data and actions directly, which is why authorization is where most of them break. We test whether one user can read or change another user's objects by altering an identifier, whether a standard account can reach administrative functions, and whether endpoints return more fields than the client ever requested. These object- and function-level flaws rarely show up in a scan but are trivial to exploit once found.
Beyond authorization we examine the practical weaknesses that production APIs develop: mass assignment that lets a request set fields it should not, missing rate limits that enable enumeration and credential stuffing, injection reachable through parameters, and GraphQL queries that can be nested or batched into a denial of service. We work from your OpenAPI or GraphQL schema where you have one, and from captured traffic where you do not.
Reporting is built for the people who own the service. Each finding names the endpoint and method, shows the request and response that prove it, scores the risk with CVSS v4.0, and recommends a fix at the right layer, whether that is a gateway policy, a code change or a schema constraint. We confirm every issue by hand so your engineers never chase a false positive.
How US engagements run
- Delivered remotely from India, 9.5 hours ahead of US Eastern in US daylight time and 10.5 hours in winter; calls and testing windows are set around your time zone at scoping
- Fixed-price proposals in US dollars, with scope, dates and the free retest written in before any work begins
- Written authorization signed by someone with authority over every target, because the federal Computer Fraud and Abuse Act and state laws make permission the dividing line
- Reports that name the requirement a test supports, such as PCI DSS 11.4, the FTC Safeguards Rule or SOC 2, without claiming a QSA, ASV or C3PAO role we don't hold
What's included
Our approach
- Specification reviewWe ingest your schema or capture traffic to enumerate every route and parameter.
- Token mappingWe obtain tokens for each role so authorization can be tested in every direction.
- Manual testingTesters exercise each endpoint for access, logic, injection and resource flaws.
- ChainingIndividual weaknesses are combined into realiztic data-access and takeover paths.
- Report & debriefWe deliver evidence-backed findings and brief your engineers on fixes.
What you receive
- Endpoint inventory tested against the API Security Top 10
- Risk-rated findings with request and response evidence
- CVSS v4.0 scores and remediation per endpoint
- Guidance on gateway, schema and code-level fixes
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- OWASP API Security Top 10
- OWASP WSTG
- OWASP ASVS
- PTES
- NIST SP 800-115
- CVSS v4.0
- CWE
- SOC 2
Frequently asked questions
Can you test an API without documentation?
Yes. A schema speeds things up, but we can enumerate an API from captured traffic, a proxy export or a client application. Giving us whatever you have, even a partial collection of requests, lets us spend more of the engagement on testing and less on discovery.
Do you test GraphQL differently from REST?
The logic and authorization questions are the same, but GraphQL adds introspection, deeply nested queries and batching that can expose data or exhaust resources. We test those specific behaviors alongside the standard object- and function-level authorization checks.
How do you avoid corrupting our data?
We prefer a staging environment seeded with test data. Where we must use production we agree boundaries first, favor read operations, and label any records we create so your team can remove them. Destructive calls are only run with explicit written approval.
Will a SOC 2 auditor accept your application pentest report?
Penetration testing isn't written into the SOC 2 criteria, yet it is common for auditors and enterprise buyers to look for a recent test. Our report records scope, dates, method and rated findings, and the retest letter shows what was fixed. Your auditor still decides which evidence they accept.
Can testing fit around our US release schedule?
Yes. Testing windows, call times and code-freeze periods are agreed around your time zone at scoping. We deliver from India, which is 9.5 hours ahead of US Eastern during US daylight time and 10.5 hours in winter, and any critical issue is passed to your nominated contact the day it is verified.