Overview
US fintechs, healthcare platforms and SaaS companies expose more through APIs than through their user interfaces, from financial data aggregation to patient-record integrations. We test object-level authorization, token handling, rate limits and partner integrations, which are the weaknesses behind many of the most serious API data exposures.
Modern products are API-first: your web app, mobile apps and partner integrations all talk to the same backend. Attackers know this — once they understand your API, they skip the user interface entirely and call endpoints directly.
The most damaging API flaws are authorization failures: changing an ID to read another customer's invoice, calling an admin-only function as a normal user, or setting a hidden field like role or price through mass assignment. Scanners can't judge who should see what. Our testers can.
We work from your OpenAPI/Swagger specification, Postman collections or GraphQL schema, plus traffic captured from your clients, to make sure every endpoint and method is covered — including old versions you may have forgotten are still live.
How testing works for US organizations
- Signed scope and written authorization before any testing, including hosting and cloud provider permissions
- Testing windows agreed around your US time zone at scoping, including after-hours windows for production
- Fully remote delivery, with internal and wireless access via VPN or a shipped test device, so no travel costs
- Reports mapped to SOC 2, PCI DSS, HIPAA and customer questionnaires, with a fixed price in USD
What's included
Our approach
- Specification reviewWe ingest your API definitions and map endpoints, methods, roles and data objects.
- Traffic analysisWe capture real client traffic to discover undocumented endpoints and parameters.
- Authorization matrix testingEvery sensitive endpoint is tested across roles and, for SaaS, across tenants.
- Input & logic testingInjection, deserialization, rate-limit bypass and business-flow abuse.
- Reporting & retestRequest/response evidence, root-cause fixes and verification after remediation.
What you receive
- Endpoint coverage list
- Findings mapped to OWASP API Security Top 10 (2023)
- Reproducible requests (cURL/Postman) per finding
- Authorization design recommendations
- Retest report and attestation letter
Standards & frameworks
- OWASP API Security Top 10
- OWASP WSTG
- OWASP ASVS
- CWE
- SOC 2
- PCI DSS
- SOC 2 CC4.1
Frequently asked questions
Do you need API documentation?
It is strongly recommended. Specifications and Postman collections let us spend paid time testing instead of discovering endpoints.
Can you test GraphQL APIs?
Yes — including introspection exposure, field-level authorization, query depth and complexity limits, and batching or aliasing abuse.
Do you test internal or partner APIs?
Yes, if they are in scope. Internal APIs often assume callers are trusted, which makes them valuable targets after an initial compromise.
Are you a PCI QSA or ASV, FedRAMP 3PAO or CMMC C3PAO?
No. We don't claim any of those statuses on this site. Most penetration tests for SOC 2, HIPAA, PCI DSS Requirement 11.4, the FTC Safeguards Rule and customer due diligence don't require them. If your contract, assessor or program requires a specific accredited provider, tell us at scoping and we'll say plainly whether we can meet it. See US compliance requirements.
Do you quote in US dollars?
Yes. US proposals are fixed-price and quoted in USD, with scope, effort, deliverables and payment terms set out in writing before work starts. See our US pricing guide for published market ranges.