API Penetration Testing

Find the flaws in your REST, GraphQL and SOAP APIs before attackers use them to reach your data.

APIs carry the data and business logic behind web apps, mobile apps, partner integrations and internal services. Because they are built to be called by software, they are easy for an attacker to script against, and a single broken permission check can expose every record behind an endpoint.

Samurai Security's CREST-accredited consultants test your APIs the way an attacker would: mapping every endpoint, trying each role and tenant against the others, and checking what happens when requests are tampered with, replayed or sent out of order. You get a clear report of what we found, how we proved it and how to fix it, and we talk your team through it.

Discuss an API Penetration Test

Get a Quote

Door handle with a keypad lock on a wooden door

What Is API Penetration Testing?

API penetration testing is a controlled, authorised attack on your application programming interfaces. We use the documentation, schemas and test accounts you provide, together with what we can discover ourselves, to look for weaknesses in authentication, authorisation, input handling, business logic and configuration.

Automated scanners are good at spotting known patterns, but most serious API flaws are about logic: a user reading another customer's data by changing an ID, a standard account calling an admin function, or a workflow that can be skipped. Finding those needs testers who understand how the API is meant to work and then try to make it do something else.

We test the API types modern applications rely on, including REST and JSON APIs, GraphQL, SOAP and XML web services, and the APIs behind mobile apps and single-page web applications.

Group working on laptops around a table in a red-lit room

Why Test Your APIs?

APIs often expose more than the user interface does. A mobile app may only show a customer their own orders, while the API behind it will return any order it is asked for. Internal and partner APIs are frequently assumed to be private and receive less scrutiny than public websites.

Testing your APIs helps you answer practical questions: can one customer or tenant reach another's data, can a low-privileged user perform privileged actions, are tokens and sessions handled safely, does the API leak more data than the client needs, and would abuse such as credential stuffing or mass data extraction be noticed or limited.

What We Test

Our testing is mapped to the OWASP API Security Top 10 and goes beyond it wherever your API's design calls for it.

Authorisation (object and function level)

Broken object level authorisation (BOLA/IDOR), broken function level authorisation and property level issues such as mass assignment and excessive data exposure. We test each role and tenant against the others.

Authentication and session handling

Login and token flows, OAuth 2.0 and OpenID Connect implementations, JSON Web Token (JWT) validation, API keys, password reset and session expiry.

Input handling and injection

Injection into SQL, NoSQL, command and template contexts, XML attacks against SOAP services (including XXE), server-side request forgery (SSRF) and unsafe deserialisation.

GraphQL-specific testing

Introspection exposure, query depth and complexity abuse, batching, field-level authorisation and resolvers that bypass the checks applied elsewhere.

Business logic and abuse

Workflow bypass, race conditions, unrestricted access to sensitive business flows, and the absence of rate limiting or resource limits that would allow scraping, brute force or denial of service.

Configuration and inventory

Security headers, CORS, verbose errors, transport security, forgotten versions and undocumented endpoints, and unsafe consumption of third-party APIs.

Our Approach

Security camera against a building with metal slats

01

Scoping

We agree which APIs, environments, endpoints, roles and tenants are in scope. The number of endpoints and roles drives the effort, so we ask for an endpoint list or a Postman collection, OpenAPI/Swagger definition, WSDL or GraphQL schema where you have one.

02

Project agreement

You receive a formal proposal setting out the scope, test approach, timings, the access we need and the cost. Testing is quoted at £1,350 per consultant day.

03

Testing

Our consultants test each endpoint and role, combining manual testing with tooling. You can choose human-led, hybrid or Katana testing. If we find a critical or high-risk issue, we contact you straight away rather than waiting for the report.

04

Report and debrief

You receive a report with an executive summary, each finding rated and evidenced, and clear remediation advice for your developers. We then talk you through the report in a debrief, so your team understands the risks and the fixes.

05

Retesting

Once fixes are in place we can re-verify them. Retesting is scoped to the number of findings to re-verify and quoted up front.

Why Choose Samurai Security?

CREST-accredited testing

Samurai Security is CREST accredited for penetration testing, so your API test is carried out to a recognised industry standard.

01

Testers who think like attackers

Our team has discovered and published more than 20 CVEs. That research mindset is what finds the logic flaws that scanners miss.

02

Clear, developer-ready reporting

Every finding comes with evidence, a risk rating and practical remediation steps, and we walk your team through the report in a debrief.

03

Transparent pricing

Our free pen test cost calculator gives an indicative estimate for an API test in a couple of minutes, with no details needed to see it.

04

Our Work

Aerial view of a residential housing estate

Strengthening Cybersecurity Resilience

“Samurai takes the time to understand our needs and helps us to be an enabler for Flagship Group’s mission. It’s always a pleasure to work with them and I’d recommend them to others.”

Enabling Remote Work for the NHS

“When I have a problem nobody else can solve, I call Samurai because I know that they’ll deliver what I need, every time, without fail.”

Incident Response Retainers To Enable Growth

“This partnership has allowed us to scale and grow with the confidence that we are protected from cyber threats around the clock.”

Client Testimonials

“Samurai takes the time to understand our needs and helps us to be an enabler for Flagship Group’s mission. It’s always a pleasure to work with them and I’d recommend them to others.”

“We were astonished by what Samurai’s Black Dragon assessment revealed, even though we thought we had everything covered. The findings spoke for themselves, and the team’s expertise and clarity were outstanding.”

"Samurai’s Black Dragon: Attack Surface Risk Assessment was exactly what we needed and something we’ve never seen done before. They turned it around quickly, highlighted risks that could have easily been overlooked, and gave us a clear roadmap for improvement."

Frequently Asked Questions

What is the difference between API testing and web application testing?

A web application test looks at the application through the browser, including its user interface. An API test goes straight to the endpoints behind it, testing every method, role and parameter directly. Many applications need both, and we can scope them together.

Which API types do you test?

We test REST and JSON APIs, GraphQL, SOAP and XML web services, and the APIs behind mobile apps and single-page applications, whether they are public, partner-facing or internal.

What do you need from us?

Ideally an endpoint list or an OpenAPI/Swagger definition, Postman collection, WSDL or GraphQL schema, plus test accounts for each role or tenant in scope and a non-production environment where possible.

Do you test against the OWASP API Security Top 10?

Yes. Our testing covers the OWASP API Security Top 10 and goes beyond it where the design of your API calls for it, particularly around business logic.

How much does an API penetration test cost?

It depends mainly on the number of endpoints and the roles or tenants to test. Testing is priced at £1,350 per consultant day, and our pen test cost calculator gives an indicative estimate. Retesting is scoped to the number of findings to re-verify and quoted up front.