TREN
Schedule a MeetingSchedule a Meeting

Penetration Testing

API Penetration Test

We test the APIs used by your mobile app, partners and internal services. We show whether one user can access another user's records or actions.

Schedule a MeetingAll services in this area

What it is

API penetration testing is performed directly through service calls, without a user interface. The most critical risk is authorization failures at the object and function level. The test checks for these separately for each role and endpoint. The method covers the OWASP API Security Top 10 and issues specific to REST and GraphQL.

Scope

  • Inventory of REST and GraphQL endpoints from documentation and real traffic
  • Object- and function-level authorization (BOLA and BFLA)
  • OAuth 2.0, OpenID Connect and access token management
  • Mass assignment, excessive data exposure and input validation
  • Rate limiting and business flow abuse
  • Old versions and forgotten endpoints

The need

When organizations need it

  • Before APIs are exposed externally for open banking, payments or partner integration.
  • When the APIs behind your mobile app have never been tested independently of the app.
  • When the authorization model between services changes during a move to microservices.

Method

How we work

  1. Inventory

    We compile the full endpoint list from the OpenAPI or GraphQL schema and real traffic.

  2. Role matrix

    We tabulate which role should access which records through each endpoint.

  3. Manual testing

    We check individually whether each role can access records and actions beyond its rights.

  4. Report and retest

    We document findings with sample requests and retest after corrections.

Outcome

What you have at the end

You receive an authorization matrix showing at which endpoint each role can exceed its rights. Your teams can repeat this check on new endpoints using the matrix.

Frequently asked questions

Our API is used only by our own mobile app. Does it still need testing?

Yes. An attacker does not have to use the app and can call the API directly. Restrictions enforced only in the app can be bypassed if not enforced on the server.

Can you test without API documentation?

Yes. We derive endpoints from application traffic. Sharing a schema or request collection increases the coverage.

We use a WAF or an API gateway. Isn't that enough?

These layers handle known attack patterns and rate limits. A request by one user for another user's record appears valid. Only the application's own authorization controls can prevent this.

Penetration Testing

Other services in this area

Let's talk about this service.

Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.

Schedule a Meeting