API Security Testing: What We Check and What We Need From You
APIs carry the data between your app, your website and your partners. They are often less protected than the pages people see, because nobody opens them in a browser. An API security test checks whether someone could read or change data they should not.
We test APIs remotely from Chittorgarh, India, for businesses in India and abroad.
Our main page for this service: API Testing.
What we look for
Following the OWASP API Security list, we check things such as:
- Broken object-level authorization: changing an ID in a request to see another customer's record
- Weak or missing authentication, including tokens that never expire
- Responses that return more data than the screen needs
- No limit on how fast one user can send requests
- Missing checks on what data is accepted
- Old versions of the API left running
What we need from you
The API documentation or a request collection, test accounts for each kind of user, and a test environment if you have one. With these we can check what each user is allowed to do, which is where most real problems sit.
How it differs from API functional testing
Functional testing checks that the API does what it should. Security testing checks that it cannot be made to do what it should not. We do both, and they work well together.
What you receive
A report with each finding, the exact request that shows it and advice on the fix. After you have fixed them, we test again.
Frequently asked questions
Can you test an API with no documentation?
Sometimes, from the traffic of your app, but it takes longer and finds less. Documentation or a request collection makes the test better.
Will testing affect our live API?
We agree the scope and timing first, and we prefer a test environment. Where only the live system exists, we keep the load light.
Do you test GraphQL APIs too?
Tell us what your API uses. We say plainly whether we can take it on before you commit.
How much does it cost?
It depends on the number of endpoints and user roles. We quote in writing after a short call.
Send us your API details
Share the documentation or describe what the API does. Call +91-86194 70448 or email contact@gtsltd.in. We work remotely, in English, with businesses in India and abroad.