API penetration testing

API penetration testing for REST, GraphQL and SOAP.

ShieldProbe Assess tests your APIs and backend services: endpoint authorization, data exposure, input handling and API workflows, using the agreed accounts and API specification. Testing is black-box or grey-box, under an agreed OWASP API Security Top 10 or full WSTG scope. A named consultant approves each finding before you see it.

Scope your API test Open the sample report

Targets: REST, GraphQL and SOAP APIs, including backend services and integrations.
Location: Internal or external
Access: Black-box or grey-box
Methodology: Agreed OWASP API Security Top 10 or full WSTG scope

The specification and the accounts shape the test.

With an OpenAPI document, GraphQL schema or WSDL, testing works from the endpoints you actually expose. Without one, it works from the endpoints it can discover within scope.

Grey-box testing uses test accounts for each role or tenant, so authorization between them can be checked directly. Black-box testing starts without credentials. Internal APIs are reached through an approved connector or access path.

Bring to scoping

Base URLs, environments, their owners and written authorization.
The API specification if you have one, and the endpoints that are out of scope.
Test accounts per role or tenant, if you choose grey-box.
Rate limits, actions that are off limits, testing windows and escalation contacts.

What an API test covers.

Test endpoint authorization, data exposure, input handling and API workflows, using the agreed accounts and API specification.

REST, GraphQL and SOAP APIs, including backend services and integrations.

Methodology: Agreed OWASP API Security Top 10 or full WSTG scope. Testing records which endpoints and workflows it reached, and which it could not.

The boundaries of this test

Third-party services your API calls are tested only where you authorize them.
Defend and Fix address supported application findings. Not every finding can be protected or patched automatically.
A clean result covers the agreed scope, access and time window. It does not prove the absence of vulnerabilities.

What we test

Web, API, network and server pentesting.

Choose the systems to test, where they run and the access we start with. Each assessment has an agreed scope and consultant-reviewed evidence.

Web applications

Customer portals, dashboards and browser-based applications.

Test authentication, sessions, access controls and business workflows. Follow weaknesses through to their demonstrated impact.

Location: Internal or external
Access: Black-box or grey-box
Methodology: Agreed OWASP Top 10 or full WSTG scope

APIs

REST, GraphQL and SOAP APIs, including backend services and integrations.

Test endpoint authorization, data exposure, input handling and API workflows, using the agreed accounts and API specification.

Location: Internal or external
Access: Black-box or grey-box
Methodology: Agreed OWASP API Security Top 10 or full WSTG scope

Networks & server infrastructure

Internet-facing services, private networks, and on-premises or cloud-hosted servers.

Test exposed services, misconfigurations and exploitable weaknesses. Validate privilege escalation and lateral movement where the agreed scope permits.

Location: Internal or external
Access: Black-box only
Methodology: Agreed PTES scope

Internal or external?

External: test internet-facing systems from our infrastructure.

Internal: reach private applications, APIs, networks and servers through an approved connector or access path.

Black-box or grey-box?

Black-box: start without supplied login credentials and test the reachable, authorized surface.

Grey-box: use supplied test accounts and context to test authenticated web and API workflows.

Network and server infrastructure assessments currently use black-box testing.

Not sure where to start? We'll help you define targets, access and permitted activities before testing begins.

Scope your assessment

Evidence you can hand to engineering and your assessor.

Each finding carries its reproduction evidence, demonstrated impact and limitations, approved by a named consultant before release. With scope agreed and access ready, the report can arrive in 48 hours, and retests of fixed findings run for 12 months under your engagement terms.

Testing an API because a partner or an audit requires it? See PCI DSS and ISO 27001 penetration testing.

Common questions

Tell us the API and the access you can give. We will agree the rest with you.

Can you test internal systems as well as public targets?

Yes. External testing reaches internet-facing applications, APIs and services from ManticoreAI infrastructure. Internal testing reaches private applications, APIs, networks and servers through an approved connector or access path. Location and access mode are separate: an internal target may still be tested without login credentials.

What is the difference between black-box and grey-box testing?

Black-box testing starts without supplied login credentials and tests what an attacker can discover and reach within the authorized scope. Grey-box testing uses supplied test accounts and context to examine authenticated web or API workflows and permission boundaries. Web and API assessments support both modes. Network and server infrastructure assessments currently support black-box only.

Start with the API your partners integrate with.

We will scope the rest of the API test with you.

Scope your API test