API Penetration Testing REST, GraphQL and gRPC
API penetration testing is the security assessment of REST, GraphQL and gRPC interfaces that exploits authorization flaws (BOLA), broken authentication, mass assignment, data exposure and missing rate limiting, following the OWASP API Security Top 10, to prove with evidence what an attacker would obtain from your endpoints.
What an API pentest is and how it differs from a web pentest
An API pentest is an API security test run from the perspective of an attacker who talks directly to the backend, bypassing the user interface. While a traditional web pentest follows the flows the browser exposes, an API test treats every documented — and undocumented — operation as a contract: who may call it, with which parameters, on which objects, and how often.
That distinction matters because the most common API flaws are not classic injections but authorization logic errors: an endpoint returning another customer's order when an identifier is swapped, an internal field accepted in a PUT body, a GraphQL mutation with no role check. Scanners rarely find these, because they require understanding the business model behind each resource. Berghem therefore combines automation for inventory and coverage with manual exploitation for authorization, logic and vulnerability chaining.
API testing can be contracted on its own or as part of the Ethical Hacking Test (EHT) when the web or mobile application consuming the API is also in scope.
What is included
What we test: the ten categories of the OWASP API Security Top 10
Each OWASP API Security Top 10 category becomes a set of test cases executed against every in-scope endpoint with every available access profile. Here is what we look for in each and why it matters to the business.
Broken Object Level Authorization
We swap object identifiers (orders, accounts, documents, users) across sessions of different customers and verify whether the backend validates resource ownership. It is the most frequent API flaw and the one that exposes personal data at scale.
Broken Authentication
We assess JWT issuance and validation (algorithm, signature, expiry, claims), OAuth 2.0 and OIDC flows, static API keys, refresh tokens, password recovery and protection against credential stuffing and brute force on login endpoints.
Property-level authorization and mass assignment
We test whether a client can read or write fields it should not: the price on an order, a user's role, an approval status. Mass assignment happens when the backend maps the request body straight onto the model with no allow-list of fields.
Resource consumption and rate limiting
We measure per-client request limits, payload size, pagination, uploads and expensive operations. Without rate limiting an attacker enumerates data, brute-forces short OTPs and drives up infrastructure or pay-per-call third-party costs.
Broken Function Level Authorization
We call administrative and cross-role operations (approve, refund, export, delete) with ordinary credentials, altering HTTP method, path or version parameters to check that access control is enforced per function and not only in the UI.
Unrestricted access to sensitive business flows
We analyse business flows that can be abused when automated — purchase, sign-up, coupons, booking, referrals — and check for anti-bot and bulk-use controls, plus protection of the expected sequence between steps.
Server-Side Request Forgery
Wherever the API accepts URLs (webhooks, imports, preview generation), we verify whether the server can be induced to reach internal networks, cloud metadata or unexposed services — a recurring escalation vector in cloud environments.
Security Misconfiguration
We cover permissive CORS, verbose error messages, unnecessary HTTP methods, weak TLS, missing headers, GraphQL introspection enabled in production, exposed Swagger documentation and default settings of gateways and frameworks.
Improper Inventory Management
We map legacy versions (/v1 still live), reachable staging environments, undocumented endpoints and forgotten integrations. Shadow and zombie APIs often retain flaws already fixed in the current version.
Unsafe Consumption of APIs
We check how your API handles data from partners and providers: validation, redirect limits, trust in unverified responses. A compromised integration must not become a direct path into your backend.
How testing changes across REST, GraphQL and gRPC
The OWASP categories are the same, but how they are exploited depends on the protocol. We adjust tooling, test cases and coverage criteria for each API style in scope.
REST APIs
We start from the OpenAPI/Swagger specification or Postman collections to build the endpoint × method × role matrix. The focus is BOLA/IDOR, mass assignment on PUT/PATCH, verb tampering, versioning, caching of authenticated responses and content validation.
GraphQL APIs
We test introspection and schema exposure, field- and resolver-level authorization, aliasing and batching to bypass rate limiting, nested queries that exhaust the server, mutations without role checks and data leakage through type relationships.
gRPC APIs
We assess server reflection, .proto definitions, metadata-based authentication, TLS and mTLS usage, authorization on bidirectional streams and message deserialization. Common web tooling does not cover gRPC, so we use dedicated tooling and manual cases.
Webhooks, SOAP and partner APIs
We cover webhook signing and replay, origin validation, SOAP with WS-Security and XML, and APIs exposed to partners and fintechs — including the technical requirements of Open Finance Brasil when applicable to your scope.
How we run an API pentest
A thorough API pentest is mostly manual and driven by access profiles. We prefer grey-box mode, with documentation and credentials for each role, because that is how authorization flaws are found in depth.
Scope and documentation
We inventory endpoints, versions, environments, user roles, tenants and integrations. We receive OpenAPI, GraphQL schemas, .proto files or Postman collections and agree on testing windows, test accounts and a channel for critical findings.
Reconnaissance and inventory
We compare what is documented with what actually responds: hidden routes, previous versions, unlisted parameters, reachable staging environments. This is where the shadow APIs nobody remembers show up.
Authentication and session
We analyse the credential lifecycle: token issuance, scope and validation, refresh-token rotation, revocation, password and OTP policies, and how the API behaves with expired, tampered or another customer's tokens.
Authorization and business logic
We execute the full horizontal (across customers) and vertical (across roles) authorization matrix on every operation, followed by flow abuse, mass assignment, race conditions and vulnerability chaining to demonstrate real impact.
Report and retest
Every finding includes a reproducible request and response, CVSS, business impact and a recommendation specific to the framework in use. After remediation we retest and issue closure evidence for auditors or end customers.
What determines the cost and timeline of an API pentest
The effort of an API security test is sized by surface and by the complexity of the authorization model, not by the number of systems. These are the factors that most influence the proposal.
Number of operations
Endpoints × methods in REST, queries and mutations in GraphQL, services and methods in gRPC. Every operation must be tested with every profile, so the operation count is the main multiplier of hours.
Profiles, tenants and roles
The more roles (customer, operator, administrator, partner) and the more tenant isolation the business requires, the larger the authorization matrix — and the higher the chance of finding meaningful BOLA and BFLA.
Protocols and authentication
Mixing REST, GraphQL and gRPC in one scope, or using complex OAuth flows with multiple identity providers, increases preparation and tooling. mTLS and message signing also require dedicated setup.
Documentation and mode
Grey-box with an up-to-date specification and per-role credentials is more efficient and deeper than black-box, which spends hours on discovery. Including a retest and integrating with a DevSecOps pipeline also affect sizing.
When an API pentest is required or expected
APIs concentrate the data regulation protects. In several sectors, API penetration testing has moved from good practice to evidence expected by auditors, regulators and enterprise customers.
In the payments ecosystem, PCI DSS requires periodic penetration testing of the cardholder data environment, and APIs that process or transmit that data are part of that scope. Brazil's LGPD, in turn, requires technical measures capable of protecting personal data — and an API pentest is the most direct way to demonstrate that the endpoints exposing that data do not allow improper access.
For financial institutions, the BACEN/CMN resolutions on cybersecurity, including 4.893, set the security policy and expected controls, while Open Finance Brasil defines specific technical requirements for APIs shared between participants. See our Open Finance security page for that ecosystem.
APIs are also the channel through which AI agents and LLM applications take action. When an agent calls your API with delegated credentials, authorization flaws gain a new abuse vector — we address that scenario under AI agent security.
Related services
The API is rarely the only asset. These services are usually combined with API testing to cover the application end to end.
Ethical Hacking Test (EHT)
Full web application and infrastructure pentest, with the API in the same scope.
Mobile Pentest
Android and iOS apps consume APIs — test the client and the backend together.
Cloud Pentest
Gateways, serverless functions and IAM that host and protect your APIs.
DevSecOps
API tests integrated into the pipeline to catch flaws before production.
Payment Security
Acquiring, digital wallet and instant-payment APIs under the PCI DSS lens.
PCI DSS Pentest
Penetration testing aligned to the PCI DSS pentest requirement, with evidence for the QSA.
Frequently asked questions about API pentesting
What is the difference between an API pentest and a web pentest?
Do I need to provide documentation and credentials for an API pentest?
Does the API pentest cover GraphQL and gRPC or only REST?
How long does an API pentest take?
Can an API pentest serve as evidence for PCI DSS, BACEN or LGPD?
Want to know what your API hands to an attacker?
In a 30-minute conversation we map the endpoints, roles and protocols in your scope and propose the most efficient API pentest format for your case.
Contact Us