Offensive security
The authorisation layer is where APIs break.
REST, GraphQL and webhook testing focused on broken object-level authorisation, data exposure and rate-limit abuse.
Test sequence
Inventory: Documented and undocumented endpoints, versions and methods.
API penetration testing checks whether your interfaces enforce authorisation on every object, for every role, on every method. Most serious API breaches are not exotic exploits — they are requests that should have been refused. We test against the OWASP API Security Top 10, with particular depth on broken object-level and function-level authorisation, which account for the majority of real-world API incidents.
For browser workflows and application business logic surrounding the interface, use Web Application Security Testing.
For device-side controls and the mobile client that consumes the API, use Mobile Application Penetration Testing.
For a wider attack path across applications, infrastructure and networks, use Penetration Testing.
€1,500 excl. VAT
Configure with our team€3,600 excl. VAT
Configure with our teamCustom scope
Configure with our teamOur experts hold certifications including OSEE, OSCP, OSWE, OSEP, OSED, OSWP, eWPTx, eMAPT, eCPPT, CRTO and CEH.
Evolvice operates certified quality-management and information-security systems under ISO 9001:2015 and ISO 27001:2022.
More than thirteen years of technology delivery inform scoping, communication, reporting and remediation support.
“Their penetration testing report was not only detailed but actionable. Our developers could immediately start fixing the issues.”
“They helped us identify critical vulnerabilities we didn’t know existed. A truly professional and responsive team.”
“From the initial scoping call to the final report, everything was handled with precision and professionalism.”
Cross-tenant and cross-user object access — the single most common API weakness.
Administrative and privileged operations reachable by lower-privileged tokens.
Introspection exposure, nested query depth, batching abuse and resolver-level authorisation.
Responses returning more than the client needs, including internal fields.
Unvalidated input binding to internal properties; injection across query and parser layers.
Enumeration, credential stuffing surfaces and denial-of-wallet conditions.
It helps and speeds things up, but it is not required. We enumerate endpoints independently and frequently find undocumented ones.
Yes. GraphQL adds introspection, query-depth and batching concerns on top of the same authorisation testing.
The APIs a web application calls are covered there. A standalone API test goes deeper: every role, every method, every object boundary, including machine-to-machine clients.
Test accounts and non-production data wherever possible. Where production access is required, it is agreed in writing and limited by scope and window.