Object and function access
Whether changing an identifier crosses a role or tenant boundary.
Check what an API allows, not just what it returns.
API penetration testing in Australia
REST and GraphQL testing focused on object-level access and token boundaries.
From A$6,000 ex GST for one API with under 50 endpoints.
Manually verified findings.
- OSCP-certified testers
- Written testing boundaries
- Actionable remediation
Sorami tests REST and GraphQL APIs for Australian teams against the OWASP API Security Top 10 2023. Testers check object and function access per role and tenant by hand. Token handling and sensitive business flows are tested too. One API with under 50 endpoints starts from A$6,000 ex GST. Scope and fee are fixed in writing before testing.
What we test
A scope with a purpose.
Tokens and input handling
Authentication flows, token expiry and unsafe data exposure in responses.
Workflow and integration abuse
Multi-step operations, GraphQL access patterns and webhooks.
What does API penetration testing test?
An API penetration test checks what the API allows, not only what it returns. A tester signs in as each agreed role and tries to reach data and functions that role should not have. Most confirmed findings on REST and GraphQL APIs sit between what the documentation says and what the server accepts.
Object level authorisation is the first check. The tester takes an identifier from one account and replays it from another account and from a second tenant. Function level authorisation is the second. Admin and support endpoints are called directly with an ordinary user token to see whether the server checks the role or trusts the client to hide the button.
Token handling comes next. The tester checks signature validation and expiry on JSON Web Tokens and session tokens. The audience claim is tested too, because a token minted for one service is often accepted by another. Rate limits are tested on login, password reset and any endpoint that costs you money per call. The test records whether a limit exists and how it responds, without load testing.
Mass assignment is tested by sending fields the client never sends, such as a role or an account balance in a profile update. Server-side request forgery is tested on every parameter that makes the server fetch a URL, including webhook registration and import features. Inventory is checked against the agreed endpoint list, so an old version or an undocumented route is found and reported rather than left out. GraphQL APIs add introspection, query depth and batched mutations to the same list.
OWASP API Security Top 10 2023 coverage
| OWASP category | What the test checks |
|---|---|
| API1:2023 Broken Object Level Authorization | Changing an object ID in each role and across tenants. |
| API2:2023 Broken Authentication | Token signature, expiry and audience checks, plus login and reset throttling. |
| API3:2023 Broken Object Property Level Authorization | Fields returned per role, and fields a request may set. |
| API4:2023 Unrestricted Resource Consumption | Page sizes, batch operations and limits on paid calls. No load testing. |
| API5:2023 Broken Function Level Authorization | Admin and privileged endpoints called directly as an ordinary user. |
| API6:2023 Unrestricted Access to Sensitive Business Flows | Multi-step flows that can be automated or replayed for gain. |
| API7:2023 Server Side Request Forgery | Any parameter that makes the server fetch a URL. |
| API8:2023 Security Misconfiguration | Error detail, CORS, HTTP methods and debug endpoints. |
| API9:2023 Improper Inventory Management | Old versions and undocumented endpoints against the agreed inventory. |
| API10:2023 Unsafe Consumption of APIs | How the API trusts data from the integrations and webhooks in scope. |
Check your own API first with the OWASP API Security Top 10 self-check. It is a self-assessment, not a test.
What we need from you
- An OpenAPI or Swagger file, a Postman collection, or an endpoint inventory.
- Two accounts per role, and a second tenant if customers share a deployment.
- A staging environment that matches production, or written production terms.
- Allow-listing of our testing addresses on the WAF or gateway.
- Rate limits, quotas and integration owners we should know about.
What you can act on
- Reproducible request and response evidence.
- Affected endpoints and role combinations.
- Server-side remediation guidance and stated coverage limits.
Reporting and retest terms are agreed in writing. The record separates verified fixes from outstanding work.
Limits matter
What this test does not cover
- Load testing and destructive rate-limit testing.
- Attacks against an integration provider.
- The web interface. Scope it separately.
The deliverable
See what you will receive
A 19-page illustrative report built from synthetic findings, not a client report. It shows scope, evidence, severity rationale and the retest record.
How long does an API penetration test take?
Testing effort and elapsed time are different numbers. The published base scope is five testing days for one web application with its API and two user roles. One API with under 50 endpoints and good documentation needs less. A larger inventory, more roles or a multi-tenant boundary need more, and we quote that in writing before the start.
Elapsed time depends on access. Testing starts once test accounts, allow-listing and the endpoint list are in place. The report follows the last testing day. The retest is booked once your team has fixed the critical and high findings.
What is in the report?
Each finding records the affected endpoint and method. It shows the exact request and response that proves the issue, with the role and tenant used. Severity comes with a rationale, so a cross-tenant read on a billing record is not graded the same as a verbose error. Remediation is written for the server side and names the control that was missing.
The report opens with a summary for the person who signed the purchase order. It states the inventory tested, the roles used and anything excluded, so a customer or auditor can see the coverage. The retest record lists what was fixed, what was partly fixed and what remains. A 19-page illustrative report built from synthetic findings shows the format.
How much does API penetration testing cost?
From A$6,000 ex GST for one API with under 50 endpoints. One web application with its API and two user roles is the published base scope at A$7,500 ex GST. That covers five testing days, the report and a retest of critical and high findings. The quote form on this page shows an indicative range once you add endpoint count or a connected web app.
The written quote turns that range into one fixed fee. Endpoint count and the number of roles drive the effort. A multi-tenant API needs a second tenant and the cross-tenant checks that go with it. An API with no documentation adds discovery time, which we show as a line item rather than hide in the rate.
API penetration testing scoping checklist
Send these seven answers and we return a fixed scope and fee. The scoping guide explains why each one changes the quote.
- Inventory. Endpoint count as path plus method, or operations for GraphQL.
- Documentation. OpenAPI or Swagger file, Postman collection, or none.
- Authentication. API keys, OAuth, JSON Web Tokens or mutual TLS.
- Roles and tenants. Role count, and whether customers share one deployment.
- Environment. Staging or production, and the testing window.
- Network controls. WAF or IP allow-list, and who can add our addresses.
- Driver. A customer request, an ISO 27001 or SOC 2 audit, or a release date.
Testers hold OSCP and OSWE from OffSec and individual CREST Registered Tester certification. Sorami is not a CREST member company. A person verifies every finding before it is reported.
Questions before you book
Practical answers.
Do you test against the OWASP API Security Top 10?
Yes. Each engagement maps findings to the OWASP API Security Top 10 2023, which is still the current API edition. The table on this page shows what the test checks for each category. The report lists the categories tested and the ones that did not apply to your API.
Can you test without API documentation?
Yes, but discovery takes time and makes coverage less predictable. We build the endpoint inventory from the client traffic and any routes we can find, agree it with you, and name the blind spots in the report rather than implying complete coverage. Missing documentation appears as a line item in the quote.
Do you test GraphQL APIs as well as REST?
Yes. GraphQL gets the same authorisation and token checks as REST, applied to queries and mutations rather than paths. We also test introspection exposure, query depth and complexity limits, and batched mutations that bypass per-request rate limits. Operations are counted for scoping the same way REST endpoints are.
How long does an API penetration test take?
The published base scope is five testing days for a web application with its API and two roles. A single API with under 50 endpoints and an OpenAPI file needs less. Elapsed time depends on when test accounts and allow-listing are ready. The retest is booked after your team has fixed the critical and high findings.
Should we test staging or production?
Staging is the default when it matches production and holds realistic data. Production testing needs written authorisation, agreed techniques and test data, a testing window and a stop-test contact. Destructive testing and denial of service are excluded in either environment. We record the choice and its limits in the report.
Ready to price your test?
The sample report is illustrative, built from synthetic findings. It is not a client report.
Last reviewed: