Services · APIs

API penetration testing for REST and GraphQL

Your API is where your data actually lives. A web or mobile app is only one client in front of it, and an attacker can skip the app and call the API directly. We test your REST and GraphQL APIs against the OWASP API Security Top 10, and a tester confirms every finding before it reaches your report.

Message us on WhatsApp See our services

What we test

We test your API against the OWASP API Security Top 10 (2023), the risks specific to APIs rather than the pages in front of them.

Object-level access controlAPI1:2023
Whether one user can read or change another user's records by changing an ID in the request. This is the most common and most damaging API flaw.
AuthenticationAPI2:2023
Tokens, API keys and JWT handling, expiry and refresh, and endpoints that forget to check who is calling.
Property-level access controlAPI3:2023
Fields a user should not see or set: data over-exposed in responses, and mass assignment that lets a request write protected fields.
Resource consumptionAPI4:2023
Rate limits and quotas, and requests that can exhaust CPU, memory or a paid third-party quota.
Function-level access controlAPI5:2023
Whether an ordinary user can reach admin functions by calling the endpoint directly or changing the HTTP method.
Sensitive business flowsAPI6:2023
Flows such as checkout, top-up or sign-up that a script can abuse at scale, and whether anything limits automation.
Server-side request forgeryAPI7:2023
Endpoints that fetch a URL you supply, which can be turned against your internal network or cloud metadata.
Security misconfigurationAPI8:2023
CORS, security headers, verbose errors, unpatched components and default settings left exposed.
Inventory managementAPI9:2023
Forgotten or undocumented endpoints: an old /v1 left running beside /v2, debug and staging hosts, and shadow APIs.
Unsafe consumption of third-party APIsAPI10:2023
The external APIs your service relies on, and whether it trusts their responses without validating them.

REST and GraphQL

We test REST and GraphQL alike. For GraphQL we also check introspection left on in production, query depth and complexity, batching abuse and authorisation on every resolver, not just the entry point. For REST we work from your routes, documented or not.

When to test your API

Before launch or a major release, so you fix problems before anything calls the API in production.
When the API backs a mobile app or a partner integration, where the client is outside your control and anyone can call the endpoints directly.
When a regulator or a customer asks. APIs are internet-facing services, which ECC control 2-11-3-1 requires entities in scope to test, and SAMA's Cyber Security Framework (3.2.4) calls for annual tests of customer and internet-facing services. Where you handle card data, PCI DSS v4.0.1 Requirement 11.4 covers penetration testing. See NCA ECC and SAMA CSF.
Before a funding round or a large customer's security review, when you may be asked for a recent penetration test report.

What we need from you

The base URL of each API in scope, for example api.example.com
A test account or token for each user role, for example customer and admin
API documentation if you have it: an OpenAPI or Swagger file, a GraphQL schema or a Postman collection. We can also work from captured traffic if you do not
An environment to test against, ideally staging. If we test production, we agree testing windows, request rates and stop conditions first

Testing is grey-box by default: we call the API with the accounts you provide, as a real client does. If you can share the source code, a white-box test lets us look deeper.

What you receive

An executive summary of your risk in business terms
A technical findings report with CVSS scores, evidence and the exact requests to reproduce each finding, so your developers can confirm it themselves
A remediation roadmap with guidance for your stack, whether REST or GraphQL
Findings mapped to the frameworks you report against, such as NCA ECC, SAMA CSF and PDPL
A record of the OWASP API Security Top 10 risks the test covered
A readout session with your team
One retest of all confirmed findings within 90 days at no extra cost, then a closure letter recording the status of each finding

If we confirm a critical finding, we tell your named contact within 24 hours, so you do not have to wait for the final report.

Price and timeline

We send a fixed price and a timeline once we know the size of your API: how many endpoints or GraphQL types it has, how many user roles it serves, and whether it is REST, GraphQL or both. There is no hourly billing, and the retest is included.

Common questions

How is API testing different from web application testing?

A web application test works through the browser-facing app; an API test calls your endpoints directly, the way a mobile app, a partner or a script does. If your API serves more than one client, or has no web front end at all, it needs testing in its own right. See web application penetration testing.

Do you test GraphQL as well as REST?

Yes. For GraphQL we test authorisation on each resolver, introspection, and query depth and complexity, alongside the same access-control and business-logic checks we run against REST.

Is an automated scan of the API enough?

Scanners find the obvious issues. Whether one customer can read another's records by changing an ID, or a checkout step can be skipped, depends on your business logic, which a scanner cannot judge. That is why a tester confirms every finding.

Will testing affect our live API or our data?

We test against the environment you give us, ideally staging. If we test production, we agree testing windows, request rates and stop conditions first, and we do not use destructive techniques unless you authorise them in writing.

Can the report be in Arabic?

Yes. You choose Arabic, English or both for every deliverable.

What happens to our data after the test?

Engagement data is stored encrypted in Saudi Arabia and destroyed at the end of the retention period in your contract. When the engagement ends, we ask you to disable or rotate the test accounts and tokens you shared with us.