Cybersecurity Services
API Security Testing: REST, GraphQL & gRPC
Discovery and exploitation testing for every REST, GraphQL, gRPC and webhook endpoint you run, including the undocumented ones, the deprecated versions and the internal services nobody meant to expose.
- OWASP API Top 10
- Covered And Exploited, Not Just Checked
- Shadow + zombie
- Undocumented And Deprecated APIs Found
- Per endpoint
- Object And Function Authorisation Tests
- Protocols
- REST, GraphQL, gRPC, SOAP
- Discovery
- Spec, Traffic, Bundles, Enumeration
- Auth Models
- OAuth2, JWT, API Key, mTLS
- Top Risk
- BOLA / Object Authorisation
- Output
- SARIF, JSON, Postman Replay
Problem
- The Issue
- Impact
The real endpoint surface, not just what the spec documents
Object and function authorisation cross-tested per identity
Schema-aware fuzzing that reaches the handler, not the validator
API security testing: why the API is tested least
Your web and mobile clients are convenience layers over an API that enforces (or fails to enforce) every authorisation rule you have.
AIPTx tests that API directly: every endpoint, every version, every object identifier, with no help from the UI that normally hides the dangerous ones.
Why Test APIs
- Key Benefits
The problem: APIs fail differently from web pages
The problems below appear in almost every assessment, regardless of stack or industry, and each is invisible to a client-driven test.
Changing one number returns another customer's invoice, the single most exploited API flaw, and one that is indistinguishable from legitimate traffic in every log.
- Endpoints nobody documentedVersion prefixes left running after a migration, deprecated releases still answering requests, and internal services that a gateway or ingress rule quietly made reachable from outside. None of them appear in the specification, so none of them are tested.
- Object authorisation fails silentlySwapping one identifier for another returns a record belonging to a different account, and the request is well-formed, authenticated and indistinguishable from legitimate use. Nothing in the logs marks it as an attack, so it survives until someone tries it deliberately.
- Enforcement lives in the clientThe web bundle or mobile app hides the privileged action, but the handler behind it never re-checks the caller's role. Any request made outside that interface (with curl, a proxy or a script) reaches the function unchallenged.
- Data leaks in both directionsResponses return the whole object and leave the client to display a subset, exposing fields the caller was never meant to read. Inward, an unfiltered request body lets a caller set attributes such as role, ownership or balance that the endpoint never intended to accept.
- GraphQL and gRPC undercountedOne /graphql path or one gRPC service is recorded as a single tested endpoint, when every resolver and every method is its own authorisation decision. Coverage reads as complete while most of the surface behind it has never been exercised.
- Machine-to-machine paths untestedLong-lived service tokens with no revocation, webhook callbacks accepted without signature verification, and rate limits applied per IP rather than per identity. These paths have no interface to drive them, so a client-driven test never reaches them.
Key Benefits
Why API security testing is essential for every business
An API Inventory That Matches Reality
Discovery routinely finds versions absent from the spec, the ones without the current fixes.
Authorisation Tested At Every Endpoint
BOLA proven by one account reading another's record, not inferred from a code review.
Fuzzing That Reaches The Handler
Typed input built from your own schema passes validation and tests the logic behind it.
Evidence A Developer Can Run
Every finding ships as a replayable request, which removes the reproduction step entirely.
Contract Changes Tested On Merge
A spec change triggers targeted testing of the endpoints it touches, before production.
Machine-To-Machine In Scope
Tokens, webhook signatures and mTLS assumptions tested with no interface to drive them.
How It Works
- Approach
- Workflow
How AIPTx performs API security testing
Discovery first, because the endpoints you already know about are rarely where the problem is. Then authenticated exploitation, endpoint by endpoint and identity by identity.
- 01
Build The Real Inventory
Specs, introspection, client bundles, proxied traffic and enumeration combined into one surface.
- 02
Model Schema & Identities
Types, required fields and relationships, plus which object belongs to which account.
- 03
Attack Authentication
Algorithm confusion, expiry and revocation, scope enforcement, refresh flows and mTLS.
- 04
Cross-Test Authorisation
Every identity against every other identity's objects, and every privileged function.
- 05
Fuzz & Abuse Flows
Typed fuzzing, mass-assignment probes, quota and rate-limit abuse, webhook forgery and SSRF.
| API Surface | What We Assess |
|---|---|
| REST & JSON-RPC | BOLA, BFLA, Mass Assignment, Over-Fetching, Injection |
| GraphQL | Per-Resolver Authorisation, Depth, Batching, Introspection |
| gRPC & Protobuf | Reflection, Per-Method Authorisation, Typed Fuzzing |
| Authentication | JWT Attacks, Scope Escalation, Key Leakage, mTLS Enforcement |
| Rate & Quota | Per-Identity Limits, Pagination Abuse, Cost Amplification |
| Webhooks | Signature Forgery, Replay Windows, SSRF Via Callbacks |
What We Cover
- Scope
What our API security testing covers
Coverage follows the OWASP API Security Top 10, with the object-authorisation classes given the weight their exploitation rate deserves.
Shadow & Zombie Discovery
Version enumeration, bundle path extraction, certificate transparency and internal exposure checks.
Object Level Authorisation
Identifiers swapped, enumerated and replayed across read, update, delete and export operations.
Function Level Authorisation
Admin route probing, HTTP method override and role escalation from low-privilege tokens.
Token & Key Security
JWT algorithm confusion, weak secrets, missing revocation, scope escalation and key leakage.
GraphQL-Specific Testing
Resolver authorisation, query depth and complexity abuse, alias and batch brute force.
Consumption & Integrations
Per-identity rate limits, pagination and cost abuse, webhook forgery and third-party data handling.
Proven Impact
- Outcomes
Benefits of API security testing
Testing the API directly finds the flaws that a client-driven assessment structurally cannot reach.
- Complete
- An inventory that matches reality
- Per object
- Authorisation tested where it fails
- Schema-aware
- Fuzzing that reaches the handler
- Replayable
- Evidence a developer can run
- Pipeline-ready
- Contract changes tested on merge
- M2M covered
- Service-to-service paths in scope
Where It Fits
- Use Cases
Where API security testing makes the biggest impact
Across industries. Across environments. For every modern business.
API-First Products
Close authorisation and quota gaps before external developers find them.
Mobile Backends
Attack the API without the client's restrictions: arbitrary identifiers, tampered payloads.
Microservices Estates
Find internal services that ingress or gateway misconfiguration made external.
Fintech & Payments
Test money-moving endpoints, webhook trust and idempotency under replay.
Financial Services
Prove per-object access rules across partner and open-banking interfaces.
Government & Public Sector
Evidence endpoint inventory and authorisation coverage for assurance reviews.
FAQ
API security testing FAQs
What do you need for API security testing — an API spec or credentials?
Authentication credentials differ in importance than a specification (OpenAPI, Postman, GraphQL schema). Both API types require two different users to validate the object and level of authorization correctly.
How does AIPTx discover undocumented and shadow APIs?
By analysing a client's bundle, enumerating the version prefix, inspecting a gateway configuration, collecting the certificate transparency/DNS information, and proxying live traffic, all undocumented endpoints are discovered and reported separately.
Does AIPTx support GraphQL security testing and gRPC security testing?
Yes. The GraphQL is tested by each resolver (introspection, depth, batching) while gRPC methods are individually tested (reflection, protobuf).
How does AIPTx perform BOLA testing (Broken Object Level Authorization)?
The agent takes turns using identity tokens to attempt to access other users' objects as read, update, delete, export, and log all successful requests as a redacted, replayable query.
Is API security testing safe to run against production environments?
Yes. Rate limits, excluding destructive methods, and read-only proof of access tokens, protect production instances; full-depth testing is typically performed in a staging environment.
Does AIPTx test API rate limiting and resource consumption abuse?
Yes, and carefully, because the honest version of this test looks like the attack it is checking for. The agent measures where throttling actually engages per identity and per endpoint, and probes unbounded pagination, oversized payloads, expensive GraphQL queries and unrestricted export operations, all inside the request-rate ceiling you set. It establishes that a limit exists and where it sits rather than trying to exhaust anything.
Find the endpoints your documentation forgot
Point AIPTx at your API with two sets of credentials and it will map the real endpoint surface, cross-test every object and function, and show you exactly which caller can reach what.
Explore other services
Web Application Security
Deep authenticated testing for the apps you ship.
Explore Web Application Security TestingAI Penetration Testing
Simulate real-world attacks to test your defences.
Learn About AI Penetration TestingVulnerability Assessment
Find, rank and fix weaknesses across the whole estate.
See How Vulnerability Assessment WorksVulnerability Discovery
The seven vulnerability classes and how each finding is validated and classified.
Discover Our Vulnerability Discovery Process