Why the web app test misses it
A web application penetration test exercises the API through the interface. An attacker does not use the interface.
The UI only ever sends the requests it was built to send. It will not request another tenant's record ID, omit a required field, send an unexpected type, call an endpoint the UI never calls, or invoke operations in an order the front end prevents. All of those are trivial for someone with a proxy and the API documentation.
That gap is why API testing is increasingly bought as a separate engagement, particularly by companies whose product is substantially an API, or who expose one to customers and partners.
What gets tested
API testing is normally framed against the OWASP API Security Top 10. The categories that produce the most serious findings in practice:
| Category | What it means | Why scanners miss it |
|---|---|---|
| Broken object level authorisation | Changing an ID returns someone else's data | Needs two valid accounts and a data model understanding |
| Broken function level authorisation | A normal user calling an admin endpoint | Requires knowing which endpoints exist |
| Broken authentication | Token handling, expiry, refresh flaws | Partially detectable |
| Excessive data exposure | The API returns more than the UI displays | Looks correct to a scanner |
| Mass assignment | Setting fields the client should not control | Needs schema knowledge |
| Lack of rate limiting | Enumeration and brute force possible | Detectable but often unreported |
| Improper inventory management | Old API versions still live and unpatched | Requires enumeration |
Excessive data exposure deserves particular note because it is invisible from the UI. The interface renders three fields; the response contains fourteen, including some that should never leave the server. Anyone reading the network tab sees them.
How API tests are scoped
By endpoint count and authentication model, not by application. Practical inputs a tester needs:
An OpenAPI or Swagger specification if one exists — this materially reduces cost, because enumeration is a large part of the work otherwise. Credentials for each role and, for multi-tenant products, accounts in two separate tenants. A description of the authorisation model. Whether there are internal or partner APIs alongside the public one.
Providing the spec is the single biggest cost saving available on an API test. Without it the tester spends days discovering what you could have handed over in a file.
GraphQL and gRPC
Both need explicit scoping and both are frequently missed.
GraphQL introduces its own issues — introspection left enabled in production, deeply nested queries enabling denial of service, and authorisation that has to be enforced per field rather than per endpoint. A REST-oriented test plan does not cover them.
gRPC requires the protobuf definitions and tooling most web-focused testers do not use by default. Confirm the provider has done it before rather than assuming API means REST.
What it costs
US market API testing runs roughly $5,000 to $30,000, driven by endpoint count, authorisation complexity and whether documentation exists. In the Indian market it is normally quoted within a broader VAPT scope.
FAQs
Why does an API need separate penetration testing?
Because a web application test exercises the API only through the interface, and the interface only sends requests it was built to send. An attacker uses a proxy and can request other tenants' IDs, omit fields, call undocumented endpoints and invoke operations out of order — none of which the UI will do.
What is broken object level authorisation?
The most serious and most common API flaw: changing an identifier in a request returns another user's or another tenant's data. Automated scanners essentially never find it because detecting it requires two valid accounts and an understanding of the data model.
What is excessive data exposure in an API?
When the API response contains more fields than the interface displays — often including data that should never leave the server. It is invisible when testing through the UI and obvious to anyone reading the network tab, which makes it a common finding in a first API test.
How is API penetration testing priced?
By endpoint count and authorisation complexity rather than by application. US market ranges run roughly $5,000 to $30,000. Providing an OpenAPI or Swagger specification is the single largest cost reduction available, because enumeration otherwise consumes a significant part of the engagement.
Does API testing cover GraphQL and gRPC?
Only if scoped explicitly. GraphQL brings its own issues — introspection left enabled, deeply nested queries causing denial of service, and per-field authorisation — that a REST-oriented plan misses. gRPC needs protobuf definitions and tooling many web-focused testers do not use by default.
Where to go next
See penetration testing services, web application testing, or what testing costs.