REST and JSON APIs
- Every documented and discovered endpoint and method
- Object identifiers in paths, queries and bodies
- Mass assignment on create and update calls
- Pagination, filtering and bulk endpoints
Stingrai, a CREST-accredited firm, tests REST, GraphQL, gRPC and SOAP APIs for broken object level authorization, authentication and business logic flaws across every role and tenant. Findings are mapped to the OWASP API Security Top 10 (2023), with published pricing for one web application and associated APIs.
APIs carry the data and business logic behind every web and mobile application, and their most damaging flaws are authorization flaws that look like valid requests. An API penetration test proves which requests return data or actions the caller should never reach.
Stingrai tests the API directly, outside the user interface, across every role and tenant in scope, and delivers a report with reproducible evidence, severity ratings and remediation guidance for each finding.
An API penetration test significantly reduces the risk of:
Customer records exposed through broken object level authorization (BOLA)
Account takeover through weak token handling, password reset or OAuth flows
Cross-tenant data access in multi-tenant SaaS APIs
Privilege escalation to admin functions through broken function level authorization
Mass assignment, abuse of sensitive business flows and unrestricted resource consumption
Black Box
Testing starts from the API as an outside caller sees it, with no credentials and no documentation beyond what is public. It shows what an anonymous client can enumerate, call and extract, including endpoints and versions the documentation never listed.
Grey Box
Test accounts for every role and tenant, plus the API definition, so every object and function can be requested as every caller. This is where BOLA, broken object property level authorization and broken function level authorization are found, and it is the core of a Stingrai API engagement.
White Box
Source code and gateway configuration are added, so authorization checks, input handling and rate limits are traced to the code that enforces them. Findings point to the exact handler or policy to change.
Authorization and Authentication (API1 to API5)
API1 Broken Object Level Authorization: object IDs requested across every role and tenant.
API2 Broken Authentication: token issuance, validation, expiry, reset and recovery flows.
API3 Broken Object Property Level Authorization: excessive data exposure and mass assignment.
API4 Unrestricted Resource Consumption: rate limits, pagination, batching and costly operations.
API5 Broken Function Level Authorization: admin and internal functions called by lower roles.
Business Flows, Configuration and Inventory (API6 to API10)
API6 Unrestricted Access to Sensitive Business Flows: purchase, signup, booking and referral abuse at scale.
API7 Server Side Request Forgery: URL fetchers, webhooks and imports reaching internal services.
API8 Security Misconfiguration: CORS, verbose errors, HTTP methods, TLS and gateway settings.
API9 Improper Inventory Management: undocumented, deprecated and non-production API versions.
API10 Unsafe Consumption of APIs: trust placed in third-party API responses and redirects.
Coverage spans REST, GraphQL, gRPC and SOAP APIs, whether they sit behind a web application, a mobile app or partner integrations. Exact coverage is confirmed at scoping and stated in the report.
Stingrai starts black-box, as an outside caller, to find what is reachable without credentials and which undocumented endpoints and versions are exposed. Testing then moves to grey-box with the API definition and a test account for every role and tenant, so every object and function is requested as every caller.
That authorization matrix is the center of the engagement. BOLA, broken object property level authorization and broken function level authorization are the most damaging API findings and the ones automated scanners miss, because the responses look valid.
On the Autonomous Pentest, Snipe works through the matrix on its own. On the Hybrid Pentest, human penetration testers test alongside Snipe throughout, chaining findings and testing the business flows that need human context.
Evidence for customers and auditors, priorities for leadership and fix-ready detail for engineering.
For engineering
Each finding is posted as soon as it is confirmed, with the request and response that prove it, the affected endpoint, severity and remediation guidance.
For leadership
A plain-language view of risk, the data and functions exposed and the fixes to prioritize first.
For security teams
Methodology, coverage and every finding mapped to the OWASP API Security Top 10 (2023), delivered as a redactable PDF.
For engineering
Fixed findings are retested on request, and their status is updated in the portal and the report.
For customers and auditors
Issued with Hybrid and human-led engagements, stating scope and testing dates. The Autonomous Pentest delivers the Pentest Report.
For the project team
Jira, Slack and GitHub integration, and direct chat with the assigned penetration testers on Hybrid and human-led tests.
Explore how we structure executive summaries, prioritized findings, evidence, reproduction steps, and remediation guidance, tailored to SOC 2, ISO 27001, PCI DSS, and HIPAA compliance.
PDF, 4 MB. No email address required.
Typical durations. The schedule for each engagement is fixed in writing at scoping.
Two published packages cover one web application and associated APIs. The Autonomous Pentest is Snipe, Stingrai's autonomous AI agent, on its own: US$3,000 one-time or US$650 per month. The Hybrid Pentest pairs Snipe with human penetration testers: US$6,800 one-time or US$1,275 per month.
Autonomous Pentest
AI Agents
Fully autonomous web application pentest powered by Snipe.
Hybrid Pentest
AI Agents + Human Experts
Snipe, our autonomous AI agent + human penetration testers working together to find vulnerabilities.
Testing a standalone API, several APIs or a larger API estate? Submit the Get a Quote form and receive pricing within 24 hours, or read the API penetration testing cost guide.
One report and its retest results produce evidence for several programs at once.
CREST-Accredited Firm
Stingrai Inc. is a CREST-accredited penetration testing provider, founded in Toronto in 2021 with an office in London. The accreditation is held by the company itself, not only by individual testers.
Named Penetration Testers
Hybrid and human-led engagements are staffed by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications. Every report is reviewed by the team lead and an engagement partner.
Published Research
Stingrai's researchers have published 18 CVEs, and team members appear in the Halls of Fame of Apple, Google, Facebook and the US Department of Defense.
Snipe and Penetration Testers
Snipe, Stingrai's autonomous AI agent, was trained on more than 6,000 HackerOne disclosure reports and works through the authorization matrix for every role and tenant. On Hybrid engagements, penetration testers work alongside it throughout the test.
Findings as They Are Confirmed
Every finding reaches the PTaaS portal as soon as it is confirmed, with the request and response that prove it and remediation guidance, so engineering starts fixing before the report is issued.
Rated 5.0 on Clutch
Stingrai holds a 5.0 rating across 20 verified Clutch reviews and 4.9 on G2, from clients ranging from startups to enterprises in healthcare, financial services and SaaS.
Stingrai uncovered vulnerabilities our vulnerability program had missed and helped us harden critical systems with practical guidance. We were impressed with their personalized, transparent approach and delivery against our timelines.
— Manager, IT, 30 Forensic Engineering
The team spent time and effort to understand the business cases and uncover vulnerabilities unique to our business. Testing was completed within the promised timeline and within the budget which is very competitive compared to the market.
— CTO, NetNow Financial Inc.
Stingrai's API penetration tests request every object and function as every role and tenant in scope, and report only what is confirmed with request and response evidence. Every finding includes remediation guidance, and retesting is included.
