CREST-Certified API Penetration Testing for UK Businesses

A small REST API engagement (under 25 endpoints, 1-2 roles) typically takes 4-5 working days. Mid-market APIs (REST + GraphQL, 25-100 endpoints, 3+ roles) take 7-10 days. Enterprise microservice meshes with 100+ endpoints take 12-15 days. Test duration is determined during scoping based on endpoint count, role complexity, and protocol mix.

Small-API engagements range from £4,000 to £7,000. Mid-market (the most commonly commissioned tier) ranges £7,000 to £12,000. Enterprise microservice or multi-protocol APIs start at £12,000. All quotes are fixed-price after scoping; no day-rate surprises.

Yes, every engagement covers all 10 categories of the OWASP API Security Top 10 (2023 edition). Findings are tagged to specific OWASP IDs (API1:2023 BOLA, API2:2023 Broken Authentication, etc.) so your audit team can submit evidence directly. We also reference the OWASP API Security Top 10 changelog from 2019 to 2023 in the executive report.

BOLA (Broken Object Level Authorization) is the #1 entry on the OWASP API Top 10 (2023). It accounts for an estimated 40% of all API attacks. BOLA happens when an API endpoint returns data based on an object ID without verifying the requesting user owns that object. Example: GET /users/123/orders returns data when called with an attacker’s auth token. Automated scanners almost never find BOLA; it requires manual role-by-role testing.

Yes, all four. REST is most common, but modern UK production environments commonly mix REST + GraphQL, with gRPC for internal microservice mesh and SOAP for legacy integrations. Each protocol has unique attack surfaces (GraphQL introspection / nested-query abuse, gRPC reflection, SOAP XXE) and we test for protocol-specific issues alongside the common OWASP API Top 10 categories.

Yes. Schema-less testing is supported but takes longer because we have to discover endpoints via traffic capture, brute-force, or proxy interception. We strongly recommend providing OpenAPI / Swagger / Postman exports if available; it makes testing more thorough and saves 1-2 days of recon. For GraphQL, introspection is enabled by default for testing (can be disabled in production).

Yes. Authentication is tested at every layer: token issuance, token validation, refresh-token handling, token replay attacks, JWT signature flaws (none algorithm, key confusion, weak secrets), OAuth 2.0 misconfigurations (open redirects, PKCE bypass, scope abuse), and OIDC ID-token validation. Authentication issues are #2 on the OWASP API Top 10.

Yes, manual exploitation of business logic is what distinguishes manual penetration testing from automated scanners. We test for OWASP API6:2023 (Unrestricted Access to Sensitive Business Flows): refund abuse, gift-card brute force, sign-up fraud, ticket scalping, racing-condition exploits in payments, and price manipulation. These findings cannot be found by signature-based tools.

Yes. OWASP API10:2023 (Unsafe Consumption of APIs) covers risks where your API trusts upstream / third-party data without validation. We test how your API handles malicious or unexpected responses from external services, important for SaaS aggregators, fintech open-banking consumers, and any API that trusts third-party feeds.

Yes. OWASP API4:2023 (Unrestricted Resource Consumption) tests for rate-limit bypass, GraphQL nested-query DoS, batch-endpoint abuse, regex DoS (ReDoS), denial-of-wallet via expensive cloud calls, and cryptographic DoS patterns. Limited-impact testing only; we never run full DoS attacks against production without explicit authorization.

All API testers are vetted UK or international engineers matched to your engagement. Relevant certifications across the team include CREST CRT and CCT App, OSCP, OSWE (Offensive Security Web Expert), and protocol-specific specialisms. SC-cleared testers are available for public-sector and regulated-financial engagements.

Yes. Standard NDA before any technical detail is shared, and we operate under a project-specific master agreement that includes data handling, deliverable IP, and breach notification clauses. Custom MSAs and AUP terms are accepted for enterprise and public-sector clients.