By EJN Labs · 17 Jun 2026 · 11 min read
API penetration testing cost in the UK typically ranges from £2,400 to £16,800 in 2026. As a rule of thumb our testers cover around 25 to 30 API endpoints per day, so a small single-service API (up to around 75 endpoints) runs about £2,400 to £3,600 (2-3 days), a standard multi-service API (around 75 to 200 endpoints) £3,600 to £8,400 (3-7 days), and a large microservices estate (around 200 to 400 endpoints) £9,600 to £16,800 (8-14 days). Endpoint count, authentication model and documentation quality drive the price.
API penetration testing cost is one of the harder line items to estimate, because an API surface is rarely as visible as a website. Two APIs that look identical on paper can differ by a factor of three in test effort once you count endpoints, authentication flows and authorisation logic. This guide gives realistic UK price ranges for 2026, explains what an API pen test cost is built from, and shows how our CREST-certified testers scope an engagement. For the wider picture across every test type, see our penetration testing cost UK hub.
What drives API penetration testing cost
Endpoint count multiplied by the number of user roles that can call them is the single biggest driver of API penetration testing cost. An API’s price is governed by how many distinct operations it exposes (endpoints, or operations in GraphQL terms) and how complex its access control is.
Every role-by-endpoint combination is a potential authorisation flaw that has to be tested by hand, because no scanner reliably detects broken object level authorisation. The drivers below are what we weigh when we scope an API security testing cost.
Endpoint and operation count
A REST API with 12 endpoints is a different job from one with 120. Each endpoint needs exercising for input validation, injection, mass assignment and authorisation across every role. As a rule of thumb our testers work through around 25 to 30 endpoints per tester day, including the authorisation checks each one needs, so the endpoint count is the single biggest driver of the day count and therefore the price. A GraphQL API behaves differently: a single endpoint can expose hundreds of fields and mutations through introspection, so a GraphQL penetration testing cost is scoped on the schema’s breadth rather than on a URL count.
REST vs GraphQL vs SOAP
The API style changes the test plan and the effort. REST is the most common and best understood, so a REST API penetration testing cost is usually the most predictable. GraphQL adds schema introspection, query-depth and batching abuse, and aliasing attacks that can defeat rate limiting, so it carries a modest premium for the extra technique coverage. SOAP and older XML-based services bring XML external entity (XXE) and WS-Security testing back into scope, which adds time. If your estate mixes styles, we scope each on its own terms rather than averaging them.
Authentication model
How clients prove who they are has a direct effect on the api pen test cost. A simple static API key is quick to assess. OAuth2 and OpenID Connect flows take longer because we test token issuance, scope enforcement, refresh-token handling and the grant types you have enabled. JWT-based auth invites its own checks: algorithm confusion, weak signing keys, missing expiry and claim tampering. Mutual TLS (mTLS) and signed-request schemes add certificate and signature validation testing. The more sophisticated the authentication, the more attack surface there is to work through.
Authorisation depth (the OWASP API Security Top 10)
Authorisation is where most serious API findings live, and it is the most labour-intensive part of the test. The OWASP API Security Top 10 puts broken object level authorisation (BOLA, the API form of IDOR) at number one. We also test broken function level authorisation (BFLA), where a standard user reaches an admin-only operation, and broken object property level authorisation, where a user reads or writes fields they should not see. Each has to be checked across every role and object, by hand, which is why an API with rich role-based access control costs more to test than a flat single-role service.
Rate limiting and business-logic abuse
APIs are uniquely exposed to automated abuse: credential stuffing against a login operation, resource exhaustion through unbounded queries, and business-logic flaws such as price manipulation or repeated use of a one-time action. Testing for missing or bypassable rate limits, and for logic that assumes well-behaved clients, takes deliberate manual effort. This is part of why a credible api security testing cost sits above the price of a quick automated scan that only checks known signatures.
Documentation quality
This is the one driver you can influence directly. A clean OpenAPI or Swagger specification, or a GraphQL schema with introspection enabled in the test environment, lets our testers spend their time on exploitation rather than reverse-engineering your endpoints. Good documentation reliably shaves days off an engagement and lowers the cost. A poorly documented API, where the tester discovers operations through traffic capture and guesswork, costs more and risks leaving hidden endpoints untested. Supplying a current OpenAPI file with a Postman collection is the cheapest way to reduce your API penetration testing cost.
API penetration testing cost by size tier (UK 2026)
The table below maps API scope to a typical day range and UK price. Pricing uses a typical UK day rate of around £1,200 to £1,300, all testing is delivered by senior and principal testers, and the price is driven by the complexity of the scope (the number of tester days). As a rule of thumb our testers cover around 25 to 30 endpoints per day, so the endpoint count is the main input to the day count. The table uses a £1,200 day rate as the baseline. These are typical 2026 ranges; the exact figure comes from a scoped quote.
| API size tier | Typical scope | Day range | Typical UK price (2026) |
|---|---|---|---|
| Small (single service) | One REST or GraphQL API, up to around 75 endpoints, 1-2 roles, good docs | 2-3 days | £2,400-£3,600 |
| Standard (multi-service) | Several related APIs, around 75 to 200 endpoints, 3-5 roles, OAuth2 or JWT | 3-7 days | £3,600-£8,400 |
| Large (microservices estate) | Many services, around 200 to 400 endpoints, complex RBAC, mTLS, mixed REST and GraphQL | 8-14 days | £9,600-£16,800 |
These bands assume manual, CREST-certified testing and reasonable documentation. A large estate with no specification and undocumented internal services can push above the top band, because discovery alone consumes days before any real testing begins. For a full breakdown of our day rates and how fixed pricing is built from them, see our pricing guide.
How an API test differs from a web application test
An API test works directly against the contract, every operation, parameter and header, because there is no rendered interface to walk through. Authorisation testing is far more central than in a typical web app, since APIs expose object identifiers openly and machine clients do not enforce the guard rails a browser would.
Buyers often assume an API is tested as part of a web application engagement, and sometimes it is, when the API exists only to serve one front end. A standalone or public API deserves its own scope, and the result looks quite different from a web app assessment even though both map to OWASP guidance.
If your application is a browser-based product backed by an API, you may want both tested together; our web application penetration testing cost guide explains how that combined scope is priced. If the API is one tier in a wider platform, an internal and external network test may also be relevant. We will tell you plainly at scoping which tests you actually need, rather than bundling everything by default.
How EJN Labs scopes and prices an API penetration test
We do not quote an API test from a one-line brief. Our scoping starts with three questions: how many endpoints or operations are in scope, what authentication and authorisation model the API uses, and whether you can provide an OpenAPI or Swagger specification (or an introspectable GraphQL schema). From there we map the engagement against the OWASP API Security Top 10 and estimate the manual effort for authorisation testing across your roles, almost always the largest single block of time.
To make it concrete, consider a typical mid-size engagement: a UK SaaS platform exposes a REST API of around 150 endpoints, four user roles, OAuth2 with JWT access tokens and a maintained OpenAPI file. At around 25 to 30 endpoints a day, that scopes to roughly six days delivered by CREST-certified senior and principal testers, landing near the middle of the standard tier at about £7,200, delivered as a fixed price. The deliverable is a report mapped to the OWASP API Security Top 10 with reproduction steps and CVSS v3.1 scoring, a prioritised remediation plan, and a free retest once your developers have applied fixes. Because the API was well documented, the budget went on BOLA, BFLA and business-logic testing rather than discovery.
As a CREST-accredited firm that also holds Cyber Essentials Plus, ISO 27001 and ISO 9001, we produce reports that stand up to auditor and customer scrutiny, not just an internal scan dump. Every quote is fixed against a written scope, so the number you approve is the number you pay. Read more about our methodology on the API penetration testing service page, and if you are weighing several vendors, our penetration testing quote and scoping guide explains how to compare quotes that look similar but are not.
How to reduce your API penetration testing cost
- Supply an OpenAPI or Swagger file. Current, accurate documentation is the single most effective way to lower the price, because it removes the discovery phase.
- Provide test accounts for every role. Authorisation testing needs credentials for each role to prove cross-role access flaws. Missing accounts slow the engagement and weaken coverage.
- Give a stable, representative test environment. A staging environment that mirrors production, with seed data, lets the tester move straight to exploitation.
- Enable GraphQL introspection in the test environment. It lets the tester map the schema in minutes rather than by hand.
- Scope tightly. If only certain services are internet-facing or handle sensitive data, prioritise those. We would rather test the right 40 endpoints thoroughly than 120 superficially.
Frequently Asked Questions
How much does API penetration testing cost in the UK?
£2,400 to £16,800 is the typical UK range for API penetration testing in 2026. A small single-service API (up to around 75 endpoints) runs about £2,400 to £3,600, a standard multi-service API (around 75 to 200 endpoints) £3,600 to £8,400, and a large microservices estate (around 200 to 400 endpoints) £9,600 to £16,800.
As a rule of thumb our testers cover around 25 to 30 endpoints per day. Endpoint count, authentication model and documentation quality are the main drivers of where you land within the range.
What is the cost difference between REST and GraphQL penetration testing?
GraphQL carries a modest premium over REST. A REST API penetration testing cost is usually the most predictable, scoped on endpoint and role count, while a GraphQL test costs more because a single endpoint can expose hundreds of fields and mutations, so the figure depends on schema breadth rather than URL count.
GraphQL testing must also cover introspection, query-depth, batching and aliasing abuse, which is where the extra time goes.
Why does authorisation testing make the API pen test cost higher?
Because authorisation flaws must be tested by hand, and no scanner detects them reliably. BOLA, BFLA and broken object property level authorisation are the most common serious API findings, and each has to be checked manually across every role and object combination, which adds tester time to the engagement.
An API with rich role-based access control therefore needs more manual time than a flat single-role service, and that extra time is what raises the api pen test cost.
Does good documentation really lower the API security testing cost?
Yes, good documentation reliably shaves days off an engagement. A clean OpenAPI or Swagger specification, or an introspectable GraphQL schema, lets testers spend their budget on exploitation instead of reverse-engineering endpoints, and that saved time comes straight off the api security testing cost.
A poorly documented API costs more and risks leaving hidden endpoints untested.
Is an API test included in a web application penetration test?
Sometimes. If the API exists only to serve a single front end, it can be tested within the web application engagement. A standalone or public API, or one with its own roles and authorisation model, warrants a dedicated scope. We advise at the scoping call which approach fits, so you only pay for the testing you need.
How long does an API penetration test take?
2 to 3 days for a small single-service API (up to around 75 endpoints), 3 to 7 days for a standard multi-service API (around 75 to 200 endpoints), and 8 to 14 days for a large microservices estate (around 200 to 400 endpoints). Endpoint count is the biggest influence on elapsed time.
As a rule of thumb our testers cover around 25 to 30 endpoints per tester day, which is why the endpoint bands above translate so directly into elapsed days.
Get a fixed-price API penetration testing quote
Tell us your endpoint count, authentication model and whether you have an OpenAPI specification, and we will return a fixed-price quote after a short scoping call. No obligation and no sales pipeline, just a clear figure from a CREST-certified tester, with a free retest included.
Leave a Reply