API Pentest

What is an API pentest?

An API pentest is a targeted security assessment of your APIs. We examine your REST, GraphQL and SOAP endpoints the way a real attacker would and demonstrate what can actually go wrong: can a user retrieve another account's data, bypass authorization or compromise your backend through the API?

APIs are the heart of nearly every modern application: mobile apps, single-page applications, microservices and B2B integrations all run on APIs. That shifts the attack surface. The vulnerabilities we report most often, BOLA/IDOR in object references, broken authentication, mass assignment and business-logic flaws, live in the API layer and are structurally missed by automated scanners.

We test against the OWASP API Security Top 10 and go further. Zolder is a CCV-certified pentest company, so you get an independent, high-quality report that is also usable for NIS2 or ISO 27001.

What we test in your API

• BOLA / IDOR - can user A reach user B's data via an object ID? The most common and impactful API vulnerability.
• Broken authentication & JWT abuse - weak token validation, key confusion, infinitely valid tokens.
• Broken function level authorization - can a regular user call admin endpoints?
• Mass assignment - sending extra fields to manipulate privileges or prices.
• Excessive data exposure - does the API return more data than the front-end shows?
• Resource consumption / rate limiting - DoS via missing limits or excessive use.
• Injection & SSRF - SQL/NoSQL injection, command injection and server-side request forgery via API parameters.

Why have an API pentest carried out?

Your API is directly reachable over the internet and often processes your most sensitive data:

• Prevent data breaches: a single BOLA vulnerability can expose your entire customer database.
• Mobile and SPA backends: the real security lives in the API behind the app, not in the app itself.
• B2B connections: partners and customers increasingly require a pentest report before connecting to your API.

Our approach

Our API pentests combine methodical manual work with targeted automation:

1. Scoping - you speak directly with the pentester. We review your OpenAPI/Swagger spec, Postman collection or GraphQL schema and determine which endpoints, roles and objects are in scope.
2. Mapping & discovery - all endpoints, methods, parameters and object IDs, including undocumented and hidden endpoints.
3. Authentication & authorization - the core. BOLA/IDOR across accounts and roles, JWT analysis, function-level authorization, session and token handling. We prefer to run an authenticated API pentest: with valid accounts at different privilege levels we uncover authorization flaws such as BOLA that stay hidden in an unauthenticated test.
4. Input & data handling - injection (SQL, NoSQL, command), mass assignment, excessive data exposure, SSRF and parameter pollution.
5. Business logic - can a user skip steps, manipulate prices or repeat one-time actions? We test this manually.
6. Reporting - executive summary and technical write-ups with reproduction steps per endpoint. We normally use a qualitative risk analysis (severity); CVSS scores are available on request. We call you immediately about critical findings.
7. Retest - after your fixes we verify the vulnerabilities are actually resolved.

What does an API pentest cost?

Our hourly rate is €175 per hour (excl. VAT). The total investment depends on the number of endpoints and the complexity of the authorization model. After a free scoping call you receive a fixed quote.