API Testing
APIs move your most sensitive data, yet they rarely get the scrutiny given to the interfaces built on top of them. We test your REST and GraphQL services directly against the OWASP API Security Top 10 — the way an attacker with a proxy and patience would — and show you where authorisation, authentication and data exposure break down.
Who this is for
- Your mobile app talks to a backend API that has never been tested in its own right
- You are opening APIs to partners or the public and need assurance before integration goes live
- A customer's due-diligence process asks how your APIs have been independently assessed
- Your web application was tested, but the API beneath it was only touched indirectly
What we test
Coverage runs in depth, not breadth alone — each stage goes past where the one above it stops.
- Objects
Broken object-level authorisation
Swapping identifiers between accounts to reach another user's records. BOLA is the most common and most damaging API flaw, and no scanner knows which record belongs to whom.
- Identity
Broken authentication
Token generation and validation, key handling and session lifetime — and the gap between the authentication described in the specification and the one enforced at runtime.
- Limits
Rate limits and expensive operations
Enumeration, brute force, and abuse of operations costly enough that a handful of requests becomes a denial of service.
- Data
Excessive data exposure
Responses returning far more than the client renders, leaking the fields the interface was designed to hide. The browser hides them; the API does not.
- Functions
Function-level authorisation
Whether privileged operations check privilege, plus mass assignment — with coverage mapped to the OWASP API Security Top 10 so the breadth can be verified.
What you get
The package in three parts — what you read, what you act on, and what happens after.
What you read
Written per endpoint, for the people who will fix it.
- Findings per endpoint, with the exact requests and responses needed to reproduce each issue
- CVSS severity ratings and a plain-English summary for stakeholders
What you act on
An ordered plan and a standard to build against.
- An ordered remediation plan
- OWASP API Security Top 10 mapping, to show coverage and direct future development standards
- Immediate escalation of critical findings to your named contact, not a surprise in the report
What happens after
Independently confirmed, not self-certified.
- Free remediation retest, so fixed endpoints are independently confirmed fixed*
* Free remediation retesting applies to penetration testing engagements. It is subject to the size of the assessment and available for three months from delivery of your report. A web application test is typically covered; a large engagement — an internal test across hundreds of systems, for example — is scoped and quoted, and a full re-assessment is always chargeable.
How it runs
The same six phases, every engagement
Threat Model Development
We agree what the exercise is replicating: the credible threats to your organisation, the starting position, the objectives, and which controls are in scope. It is also where disruption is bounded, so the test does not cost you a working day.
Information Gathering
Enumerating the systems and services actually in play from that starting point, so the attack surface is mapped as it is rather than as the asset register describes it — and choosing tools and techniques that suit it.
Vulnerability Identification
Examining that surface for weakness, using automated tooling for breadth and manual technique for everything a scanner cannot reason about. Neither finds what the other does, which is why the blend is deliberate.
Attack Vector Development
Weighing each weakness against your actual environment — how exploitable it really is, what skill it demands, what it would cost you. The output is the routes that are practical here, not the ones theoretically possible somewhere.
Exploitation
Where it is appropriate, we exploit, which usually opens a fresh attack surface and sends us back round the cycle. Where exploiting would cause harm we verify the finding is genuine rather than a stale banner, and assume the worst case.
Reporting
One document for two audiences: an executive summary your board can act on, and the technical chain your engineers can reproduce step by step, each finding carrying its severity and its remediation.
Prerequisites
- API documentation, an OpenAPI/Swagger specification or a Postman collection where available
- Test credentials or keys for each access level in scope
- A signed Laneden authorisation form, and allowlisting of Laneden's public IPs where required
Frequently asked questions
We have no formal API documentation. Can you still test?
Yes. We can build a working map of the API by proxying the client applications that use it, though good documentation lets us spend more of the engagement on depth rather than discovery.
Do you test GraphQL as well as REST?
Yes. GraphQL brings its own issues — introspection exposure, query depth and batching abuse, and authorisation applied per-resolver rather than per-endpoint — and we test for all of them.
Our API is only used by our own mobile app. Is it really at risk?
Yes. Anything the app can call, an attacker can call directly with the app removed from the equation. 'Internal use only' is not a security control once the API is reachable from the internet.
Will testing affect our production API?
We prefer a staging environment with production-like data controls, but we regularly test production safely: no destructive operations, agreed rate limits and defined testing windows where needed.
Related services
API Stress Testing
APIs usually fail under load before they fail under attack — on launch day, during a campaign, or when a client integration ramps up.
Learn more →
Web Application Testing
Your web applications are your most exposed attack surface.
Learn more →
External Infrastructure Testing
Everything you expose to the internet — mail, VPN, remote access, forgotten subdomains — is being probed constantly by people who never asked permission.
Learn more →
Ready to test your defences?
Tell us about your API testing requirement — we'll come back with a scoped proposal within two working days.
Free remediation retesting* to confirm your fixes (subject to assessment size).