API penetration testing for REST and GraphQL
API penetration testing is a manual attack on the interfaces your apps, partners and integrations call directly. Most serious API breaches come from broken authorisation: an API that returns another customer's object because the ID changed. ITovio tests every endpoint and role for that, plus mass assignment, SSRF and business-flow abuse, and proves each finding.
Enterprise only. Cyber security is the one service ITovio offers at enterprise level: established companies and enterprises with production systems worth attacking properly. We do not sell low-budget scans or small-business security packages.
- Platforms whose mobile app, single-page front end or partners talk to a public API.
- Companies exposing GraphQL, webhooks or partner integrations.
- Enterprises with internal APIs that became reachable through a gateway, a migration or a forgotten version.
- Teams preparing for an enterprise customer's security review of their API.
Definitive results, not maybes
Proven, not suspected
Every finding in the report is exploited by hand and shipped with a working proof of concept, reproduction steps and evidence. No unverified scanner output, no "potential" issues padding the page count.
Ranked by business impact
Severity is scored with CVSS and then argued in plain language: what an attacker reaches, which data, which customers, what it would cost you.
Closed means closed
After you fix, we attack the same issue again. The retest report states, per finding, whether it is closed, partly closed or still open.
A clean result is still a result
If a target holds, the report says exactly what was attacked, how and for how long, so "nothing exploitable found" is evidence you can hand to a customer, auditor or board.
What we test, mapped to the OWASP API Security Top 10
| Risk | How we attack it |
|---|---|
| Broken object level authorisation | Every object ID, in every endpoint, swapped between users and tenants; UUIDs harvested from other responses rather than guessed |
| Broken authentication | Token issuance and validation, JWT algorithm and key confusion, refresh token reuse, API keys in clients, OAuth flows |
| Broken object property level authorisation | Mass assignment of fields such as role, price or owner; excessive data returned and filtered only in the client |
| Unrestricted resource consumption | Missing limits on pagination, batch size, file size and expensive operations, tested safely without taking you down |
| Broken function level authorisation | Admin and internal functions callable by ordinary users, HTTP method switching, version downgrades |
| Access to sensitive business flows | Automated abuse of sign-up, checkout, booking, voucher and referral flows |
| Server-side request forgery | URL and webhook parameters pointed at internal services and cloud metadata endpoints |
| Security misconfiguration | CORS, verbose errors, debug and documentation endpoints left open, inconsistent behaviour across gateways |
| Improper inventory management | Old API versions, shadow endpoints and staging hosts still reachable and still trusted |
| Unsafe consumption of APIs | Trust placed in third-party API responses that an attacker can influence |
GraphQL gets its own pass
- Introspection and schema reconstruction even when introspection is disabled.
- Authorisation on every resolver and nested field, not just the top-level query.
- Batching and alias abuse to bypass rate limits and brute-force protections.
- Query depth and complexity limits, tested without degrading service.
Asked before most engagements
What do you need to test an API?
Is API testing included in a web application test?
How do you avoid damaging data?
Do you test rate limits?
Reviewed by the ITovio security team on 3 November 2026.
Related
Web application penetration testing
Read itServiceMobile app penetration testing for iOS and Android
Read itGuideWhat attackers exploit in 2026, and what we test for
Read itGuideHow to scope a penetration test
Read itAll specialist testing: Web application testing, Cloud testing, Network and Active Directory, Mobile app testing, AI and LLM testing, Red team and attack simulation.
Find out what an attacker would find first.
A 30-minute scoping call, then a written scope with targets, depth, windows and deliverables before you commit. Enterprise engagements only.
