API penetration testing

Why APIs need their own test

Any control that lives only in the UI can be bypassed by calling the API directly. And the most serious API flaws — one customer reading another's invoices, a regular user calling an admin function — are authorization flaws: a tool sees two valid responses and cannot tell that one of them should not exist.

Coverage: OWASP API Security Top 10

• API1 · BOLA/IDOR — access to other users' and tenants' objects.
• API2 · Authentication — tokens, JWT, OAuth/OIDC, API keys, account recovery.
• API3 · Object property authorization — fields exposed or writable when they should not be.
• API4 · Resource consumption — missing limits, cost and downtime.
• API5 · Function-level authorization — admin routes reachable by regular roles.
• API6 · Sensitive business flows — abusive automation of purchases, coupons, sign-ups.
• API7 · SSRF, API8 · misconfiguration, API9 · inventory and API10 · unsafe consumption of third-party APIs.

What we need from you

• A specification (OpenAPI/Swagger, GraphQL schema, .proto files or a Postman collection).
• At least two accounts per role, across two tenants where relevant.
• A staging environment with realistic data and tester IPs allowed through the WAF.

Typical API findings

• Changing an identifier in the URL returns another customer's data (BOLA/IDOR).
• Fields such as role, price or tenant_id accepted in the request body (mass assignment).
• Admin routes protected only in the frontend.
• JWTs accepted without proper signature, expiry or audience validation.
• Old API versions still live without the current version's controls.
• Missing limits allowing mass enumeration or runaway cost.

A pentest that holds up in audits

The report includes scope, dates, methodology, justified severity and retest evidence — what auditors and customers look for under SOC 2 (CC4.1, CC7.1), ISO 27001 (A.8.8, A.8.29), PCI DSS 4.0 (requirement 11.4), HIPAA, GDPR (Art. 32), NIS2 and DORA. We also issue an attestation letter you can share with customers without exposing technical detail.

Why Pentest Machine

• The founder runs tests and owns quality. 20+ years of experience, an international career at six of the world's largest companies and talks at OWASP AppSec USA, Black Hat and several BSides. He takes part in testing and reviews every report before delivery.
• Only senior specialists attack. In-house tooling and AI speed up repetitive work; deciding what to exploit and how to chain it stays human.
• Commercial transparency. Fixed price within 24h, NDA before scoping, retest included and invoicing in the US, EU or Brazil.
• A report for three audiences: the board, developers and auditors.

What you get

• Findings with reproducible request/response pairs, severity and business impact.
• Attack chains, not just isolated items.
• Code- and architecture-level remediation.
• Retest included and an updated report for customers and audits.

Frequently asked questions

Further reading

• API penetration testing guide: OWASP API Top 10
• BOLA in APIs: the number one finding
• JWT and OAuth mistakes
• Penetration testing cost

Other services