API penetration testing
Your SPA is a skin. The API is the product. We test REST, GraphQL and internal service APIs for the authorisation bugs that turn one user's token into everyone else's data.
What this engagement is
Modern Australian products ship a JavaScript front end and a thick API. Testers who only click the UI miss entire endpoint families, old versions still routed in production, and GraphQL fields nobody meant to expose. Attackers do not have that limitation.
API penetration testing against the OWASP API Security Top 10 is how you find broken object-level authorisation, function-level gaps, mass assignment and excessive data exposure, the class of bugs that dominate SaaS breach reports.
We work from documentation if you have it, and from traffic and discovery if you do not. Either way every finding is reproduced with a request you can paste into a ticket.
What we actually look for
Broken object-level authorisation
Swap an ID, change a UUID, walk a collection. If the API trusts the client, we will prove it.
Broken function-level authorisation
Admin actions reachable by a standard token, hidden verbs, and roles that only exist in the UI.
Mass assignment
Binding extra fields on create/update: role, price, tenant, verified flags.
Excessive data exposure
Serialisers that return the whole object and hope the client is polite.
GraphQL-specific issues
Introspection in production, nested queries, batching, and authorisation that only wraps some resolvers.
Authn artefacts
JWT alg confusion, refresh-token theft, API keys in mobile binaries, leaked Postman collections.
Questions buyers ask before they sign
Do you need a Swagger or OpenAPI file?
It helps. It is not required. We will discover endpoints from the front end, mobile traffic and conventional paths if documentation is missing or stale, which it often is.
Can you test internal APIs?
Yes, over VPN, a jump host, or a dedicated test environment. Internal APIs are frequently the highest-risk ones because they were never designed to face a hostile caller.
REST and GraphQL in one engagement?
Usually yes if they serve the same product. We scope by surface, not by protocol fashion.
How is this different from a web app test?
A web test follows the UI. An API test follows the contract, including endpoints the UI never calls. For a SPA we almost always recommend both, scoped as one engagement.
Often scoped alongside
Web application penetration testing
Your web app is the front door to customer data, payments and admin. We test it logged in, role-aware, reading the JavaScript and probing th…
Learn more > [mob]Mobile app penetration testing
The store listing is not the threat model. We assess the iOS and Android clients and the APIs they call, on-device and on the wire, mapped t…
Learn more > [cld]Cloud security review
Most cloud incidents are not zero-days. They are a public bucket, an over-privileged role, a key in a repo, and no logging when it matters. …
Learn more >Scope this test
Send the target, the roles and the deadline. You will get a fixed quote in AUD, usually within two business days.