Book a scoping callBook a call

Right response, wrong tenant

We test REST, GraphQL, SOAP and other application APIs across roles, objects and actions to find broken authorisation, unsafe input handling, excessive data exposure and missing rate limits.

Who can reach what

Test the access matrix object by object

We send the same calls with different identities, roles and object IDs. A finding is confirmed when a user can reach data or an action outside the access rules you intended.

Object-level checks: swap an ID, read another tenant
Function-level checks: a user hits an admin route
Each confirmed leak documented with the data it exposes
endpoint authorization
endpointanonuseradmin
GET /orders/{id}–✗✓
PATCH /orders/{id}–✓✓
DELETE /users/{id}––✓
GET /admin/config–✗✓
→GET /api/orders/1043 (id swapped from 1042)
←200 OK { "tenant": "globex", … } ← not the caller's
What we look for

Where the contract breaks

Our methodology covers the OWASP API Security Top 10 in full, then extends it to protocol-specific weaknesses, injection, business logic and the way your APIs are connected.

Broken object-level authorizationBOLA / IDOR

swap an ID in the request and read another tenant's record.

Broken function-level authorization

admin-only endpoints that still answer an ordinary user's token.

Mass assignment and over-posting

extra fields in the request body that quietly set role, price, or ownership.

Excessive data exposure in responses

endpoints returning full objects and trusting the client to hide the rest.

Missing rate limits and resource exhaustion

no throttle on login, export, or search, so one caller can drain it.

5 checks
Broken object-level authorizationBOLA / IDOR

swap an ID in the request and read another tenant's record.

Broken function-level authorization

admin-only endpoints that still answer an ordinary user's token.

Mass assignment and over-posting

extra fields in the request body that quietly set role, price, or ownership.

Excessive data exposure in responses

endpoints returning full objects and trusting the client to hide the rest.

Missing rate limits and resource exhaustion

no throttle on login, export, or search, so one caller can drain it.

How we test

A full API pentest, from discovery to confirmed impact

Step 01

Map the complete API surface

We map documented and hidden operations, versions, schemas, authentication schemes, integrations and interface styles including REST, GraphQL and SOAP.

Step 02

Test the API Top 10 and beyond

We test authentication, authorisation, injection, input handling, resource exhaustion, SSRF, inventory, unsafe API consumption and business logic.

Step 03

Validate, chain and document impact

We reproduce each weakness, confirm the exposed data or action, follow useful connections and document the request evidence your team needs.

What you get

A finding for each affected endpoint, with the request to reproduce it

Your engineers replay every request and confirm each endpoint answers only who it should.

Penetration Test Report
acme-app / api / engagement summary
01A finding for every affected endpointSeverity reflects the exposed data or action and the conditions required to reach it.
02The exact request to reproduce itMethod, path, headers and body, replayable first try.
03Fix guidance for your frameworkWhere the authorization check belongs, in your stack.
04Free retesting for one yearAfter you remediate a finding, we rerun the original proof in the tested context and record the result.
The actual report, page by page
Watermarked sample report page: The report your team receives
01The report your team receives
Watermarked sample report page: Executive summary
02Executive summary
Watermarked sample report page: Findings, ranked by impact
03Findings, ranked by impact
Watermarked sample report page: Recommendations
04Recommendations
Watermarked sample report page: A finding, reproduced in full
05A finding, reproduced in full
5 sample pages

You're seeing 5 pages. The full report is the complete PDF a customer receives.

Confirmed API findings appear in Outer Core with the request, response, affected role and exposed data or action. Your engineers can replay the evidence, discuss the fix and request a retest.

See how delivery works

Explore other surfaces

Web ApplicationNetworkCloudMobileSource CodeAI / LLM
Get started

Find the leaking cell before an attacker maps it

Book a scoping call and we'll define the endpoints, roles, access and testing depth together. Confirmed findings will appear in Outer Core during the engagement.

Book a scoping call