Testing of the REST, GraphQL and mobile back-end APIs that increasingly carry the most sensitive data in modern applications. APIs often expose logic and records that the front end never shows.
We prove authorisation flaws across users and tenants, surface the endpoints the UI hides, and test REST and GraphQL to the OWASP API Top 10.
APIs expose objects and records directly, so the most damaging flaw is authorisation: reading or changing another user's or tenant's data by changing an ID.
We test for broken object-level authorisation (BOLA), broken function-level authorisation and broken authentication across every role, proving where one account can reach another's data across user and tenant boundaries.
Modern back ends span REST and GraphQL, and both introduce abuse paths, from GraphQL introspection and nested queries to missing rate limits that enable enumeration and denial of service.
We test REST and GraphQL for injection, introspection abuse, resource exhaustion and rate-limiting gaps, mapped to the OWASP API Security Top 10, and confirm impact safely.
An API finding needs the exact request and response for a developer to reproduce and fix it.
Each finding includes the reproducible request/response, risk rating and remediation, followed by a retest to confirm the fix.
It is focused testing of the REST, GraphQL and mobile back-end APIs that carry the most sensitive data in modern applications. APIs often expose logic and records the front end never shows, so they are tested directly, mapped to the OWASP API Security Top 10.
Because APIs have their own risks, especially authorisation. Broken object-level authorisation lets one user read another's records by changing an ID, and undocumented endpoints expose data the UI hides. These are missed by testing only the front end.
Yes. We test both, including GraphQL-specific issues such as introspection abuse, deeply nested query resource exhaustion and authorisation gaps between resolvers.
Ideally API documentation or an OpenAPI/GraphQL schema, test accounts across each role and tenant, and a test environment. We can also work from captured traffic and the mobile client where documentation is limited.
Yes. Findings and any data encountered are isolated to your organisation and handled in access-limited environments we control in Australia. Nothing is pooled, sold or fed into public models.
Scope an API penetration test mapped to the OWASP API Security Top 10. Fixed scope, fixed price, no obligation.
No obligation, no sales pressure. A senior operator replies within one business day.
