Short answer
An API penetration test checks whether a caller can reach objects, fields, or functions they should not. Broken object-level authorization is the most common serious API flaw, so it gets the most time: every endpoint that takes an ID is tested across two users and, where it applies, two tenants.
What an API pentest covers
The agents map the API by method, role, and parameter, then rank endpoints by value: anything that returns another customer's data, changes money or permissions, accepts a URL, or receives webhooks comes first. Schema and configuration checks run in parallel so they never crowd out the authorization work.
OWASP API Security Top 10
Every test covers the 2023 OWASP API Security Top 10. The right-hand column shows how each risk is tested.
| Risk | How Helix tests it |
|---|---|
| API1 Broken object level authorization | Swap object IDs between users and tenants on every read, update, and delete |
| API2 Broken authentication | Token issue, expiry, refresh, and revocation; JWT validation; password reset and API key handling |
| API3 Broken object property level authorization | Mass assignment of fields like role or owner; responses that return more properties than the caller should see |
| API4 Unrestricted resource consumption | Whether pagination, upload size, and rate limits exist, checked with small bounded requests and never as a load test |
| API5 Broken function level authorization | Admin and internal endpoints called with ordinary user tokens, and method switching such as GET to DELETE |
| API6 Unrestricted access to sensitive business flows | Signup, checkout, invite, and referral flows that can be replayed or skipped |
| API7 Server-side request forgery | Webhook URLs, imports, previews, and any parameter that makes the server fetch a resource |
| API8 Security misconfiguration | CORS, verbose errors, debug endpoints, TLS, and headers |
| API9 Improper inventory management | Old API versions, undocumented endpoints, and staging hosts inside the signed scope |
| API10 Unsafe consumption of APIs | How your API trusts data from third-party APIs and webhooks it receives |
Injection, deserialization, and race conditions are tested too, wherever the API passes input to a database, template, shell, or parser.
What to provide
- The base URLs and environments in scope. Each one is checked for ownership before testing.
- Two accounts or API keys for each role, in two separate tenants if the API is multi-tenant. Credentials are stored sealed and every access is audited.
- An OpenAPI specification, Postman collection, or GraphQL schema if you have one.
- For white box, the source archive. It is uploaded in the portal and pinned by SHA-256 to the signed scope.
Not sure which access level fits? Read black vs gray vs white box testing.
How the test runs
- Sign the rules of engagement in the portal. The signature covers the exact hosts, exclusions, and test window.
- Map and rank. Agents enumerate endpoints by role and decide where an attacker would start.
- Test in parallel. Authorization, authentication, injection, SSRF, and configuration lanes each run as their own agent in an isolated sandbox, and each records what it tried.
- Verify independently. A different agent replays every candidate finding. Anything it cannot reproduce is dropped or sent to a human.
- Report and retest. Findings land in the portal as tickets with replayable requests and a fix. Mark a fix ready and the agents attack it again, free.
Testing production safely
Testing is detect-only by default. There is no denial of service, no unbounded brute force, and nothing destructive outside records the test creates itself. Every request passes a scope guard that blocks unauthorized hosts, including redirects. Secrets and personal data are masked before they reach a finding. Agents run on private inference, so your requests, responses, and findings are not sent to a third-party model provider.
Pricing and retesting
| Access | Price | Scope |
|---|---|---|
| Black box | $7,000 USD | Typical single API, no internal access |
| Gray box | $10,000 USD | Typical single API with test accounts and context |
| White box | From $10,000 USD | Source-assisted, priced on codebase size |
Retesting is free and unlimited for every engagement. Larger API estates and multiple services are scoped before testing starts. If your API sits behind a web app, the web application penetration test covers both.
Frequently asked questions
How much does an API penetration test cost?
A typical, well-bounded single API costs $7,000 USD black box or $10,000 USD gray box. White-box tests with source code start at $10,000 USD. Retesting is free and unlimited for every engagement. Larger API estates are scoped and priced before testing starts.
What is the difference between API security testing and an API penetration test?
API security testing often means automated scanning in CI, which finds known patterns and schema problems. A penetration test tries to prove impact: one account reading another account's objects, a user calling an admin function, a webhook that makes the server fetch an internal address. Helix runs the scanning checks first, then spends most of the test on authorization and logic.
Do you test GraphQL APIs?
Yes. GraphQL gets the same authorization testing as REST, applied to every resolver: nested fields and edges must check the caller on each hop, and aliased or batched queries must not pull other users' objects. Where an API exposes both REST and GraphQL, the same rule is tested on both.
Do we need an OpenAPI specification?
No, but it helps. Without one, the agents build the endpoint map from traffic and client code, and the report states which parts could not be enumerated. With a spec, a Postman collection, or GraphQL introspection, coverage is wider and the test spends less time on discovery.
Can you test a production API?
Yes, within the signed rules of engagement. Testing is detect-only by default, with no denial of service and no unbounded brute force. Rate limits are checked with small, bounded bursts. Use staging when you want state-changing tests against real workflows.