API penetration testing: REST, GraphQL and OAuth security

APIs are the nervous system of your digital business. They connect services, expose data and move money. We assess their security following the OWASP API Security Top 10, with an attacker's rigor and the precision of a specialized technical team.

APIs are the new attack perimeter

In 2023, more than 40% of data breaches in digital companies originated in a poorly protected API. The problem isn't always authentication: often it's authorization. An endpoint that returns any user's data if you change the ID in the URL. An internal API exposed without protection because it's only for internal use. A token that never expires. These flaws are silent and easy to exploit for someone who knows how to look for them.

What we audit

  • BOLA (Broken Object Level Authorization): access to other users' resources
  • Broken Authentication: weak tokens, no expiration, no revocation
  • Excessive data exposure: responses with more information than necessary
  • Rate limiting and protection against API abuse
  • SSRF, injections and input validation in API parameters
  • OAuth 2.0 and OpenID Connect flows: redirect_uri, PKCE, scope escalation
  • GraphQL: introspection, batching attacks, field-level authorization

How we audit an API

  1. Endpoint mapping: We identify all endpoints, HTTP methods, parameters and authentication formats. We review the documentation if it exists (Swagger, OpenAPI).
  2. Authentication and authorization analysis: We test the authentication mechanisms and verify that authorization works correctly at object and function level.
  3. Fuzzing and injections: We send malicious payloads to detect injections, unexpected behavior and server error exposure.
  4. Business logic testing: We assess transactional flows: can a standard user perform admin actions? Can they access other users' data?
  5. Exploitation and documentation: We confirm each finding with a clear proof of concept and classify it by severity.

Deliverables

  • Technical report with every in-scope endpoint and its findings
  • Reproducible PoC for each vulnerability (requests, responses, payloads)
  • Attack surface map of your API
  • Specific remediation recommendations (not generic)
  • Closing meeting with the backend development team

Common use cases

  • SaaS platform APIs with multi-user access and sensitive data
  • Internal microservices with service-to-service communication
  • E-commerce APIs with payment and order management endpoints
  • Mobile applications whose logic resides in the backend API
  • APIs exposed to partners or third parties via API keys
  • Banking and fintech APIs subject to DORA or PSD2

Frequently asked questions

Do you need access to the API documentation (Swagger/OpenAPI)?

It's useful but not essential. We can work in black-box mode by intercepting the traffic of the application that consumes the API. Documentation speeds up the process and improves coverage.

Do you audit internal APIs or only internet-facing ones?

Both. In fact, internal APIs are frequently the most vulnerable because it's wrongly assumed that only employees use them. Lateral movement in an attack usually leverages exactly this type of API.

What's the difference between auditing a REST API and a GraphQL one?

GraphQL has specific attack vectors: introspection can reveal the entire data schema, batching enables application-level DoS, and field-level authorization is harder to implement correctly. We cover both with adapted methodologies.

How long does an API audit take?

Between 3 and 7 business days for the technical phase, depending on the number of endpoints and the complexity of the authentication and business flows.