Skip to main content
Stealth Layer Security

Service

API Security Testing

Authorized assessment of REST, GraphQL, and internal APIs against the OWASP API Security Top 10, with focused attention on authorization flaws, business logic abuse, and data exposure.

What We Test

Coverage areas applied through manual validation and tool-assisted analysis.

  • Broken object level authorization (BOLA / IDOR)
  • Broken authentication and token handling
  • Broken object property level authorization
  • Unrestricted resource consumption and rate limiting
  • Broken function level authorization
  • Unrestricted access to sensitive business flows
  • Server side request forgery via API endpoints
  • Security misconfiguration and verbose errors
  • Improper inventory and unsafe consumption of APIs

Methodology

Testing is structured around the OWASP API Security Top 10 and supplemented by manual case-building against your API's specific workflows, authorization model, and trust boundaries.

We work from documentation when available and reverse the API surface when it is not, confirming findings against live behavior before reporting.

Deliverables

What you receive at the close of the engagement.

  • Executive summary
  • Technical findings with verified reproduction steps
  • Severity and business impact ratings
  • Evidence including requests, responses, and screenshots
  • Prioritized remediation guidance
  • Optional retest summary

Who This Service Is For

Organizations and product teams that most commonly engage us for this assessment.

  • Public APIs
  • Internal APIs
  • Mobile backends
  • SaaS platforms
  • Partner integrations
  • GraphQL APIs
  • REST APIs
  • Microservices

When Organizations Typically Need This Assessment

Common moments in a product or compliance lifecycle where this assessment adds the most value.

  • Before launching a new API or major endpoint
  • Before opening an API to partners or customers
  • Before SOC 2 or ISO 27001 readiness
  • After significant changes to authentication or authorization
  • Following a suspected incident involving the API
  • Before handling regulated or sensitive data via the API
  • Prior to funding or acquisition due diligence
  • As part of a periodic security assurance program

Engagement Timeline

A typical engagement moves through the following phases. Exact durations vary with scope and complexity.

  1. Scope Definition

    Endpoints, roles, environments, and workflows are documented.

  2. Authorization

    Written authorization and Rules of Engagement are signed.

  3. Information Gathering

    We map endpoints, auth flows, and trust boundaries from documentation or traffic.

  4. Manual Assessment

    Manual testing of authorization, business logic, and data exposure across the API surface.

  5. Validation

    Findings are reproduced against live behavior and false positives are removed.

  6. Reporting

    Executive summary and technical findings with evidence and remediation.

  7. Debrief

    Walkthrough of findings with engineering and product stakeholders.

  8. Optional Retesting

    Confirmation that reported issues have been resolved.

Example Finding

Illustrative only. Not a real client engagement. Provided to convey the level of detail included in reports.

CRITICALIllustrative example

Broken Object Level Authorization (BOLA) on Invoice Endpoint

Business Impact
Any authenticated user could retrieve invoices belonging to other customers by incrementing a numeric invoice ID, exposing financial and personally identifiable information across the customer base.
Recommendation
Enforce object-level authorization on every request by verifying that the caller owns or is entitled to the requested resource, and add regression tests that assert cross-account isolation.

Frequently Asked Questions

Answers to the questions clients most often ask before engaging us for this assessment.

How long does an API security assessment take?

Typical engagements run one to three weeks depending on the number of endpoints, authentication flows, and business workflows in scope.

Do you test REST, GraphQL, and internal APIs?

Yes. We test REST, GraphQL, gRPC-over-HTTP, and internal service-to-service APIs, adapting the methodology to each style.

What methodology do you follow?

Testing is structured around the OWASP API Security Top 10 and supplemented by manual case-building against your API's authorization model, workflows, and trust boundaries.

Do we need to provide API documentation?

Documentation (OpenAPI, Postman collections, GraphQL schemas) accelerates coverage, but is not required. When documentation is unavailable, we reverse the API surface from the client and network traffic.

Will testing affect our production APIs?

We prefer a staging environment. When production testing is necessary, we agree on rate limits, avoid destructive payloads, and coordinate a testing window.

Do you provide remediation guidance?

Yes. Every finding includes prioritized, engineer-ready remediation guidance including framework-specific recommendations where relevant.

Can you retest after we fix the findings?

Yes. A retest summary is available to confirm reported issues have been resolved.

Do you sign NDAs?

Yes. We sign mutual NDAs before receiving any documentation or credentials.

Related Resources

Additional context on how we work, what we deliver, and how we protect client data.

Request this assessment View methodology