Overview
UK products increasingly live behind APIs: open banking connections, marketplace feeds, mobile back ends and partner integrations. Each one is a door to customer records. We exercise every endpoint with real tokens for each role, look for one account reaching another's data, and give your developers request-level evidence they can replay against a staging build.
An API exposes data and actions directly, which is why authorisation is where most of them break. We test whether one user can read or change another user's objects by altering an identifier, whether a standard account can reach administrative functions, and whether endpoints return more fields than the client ever requested. These object- and function-level flaws rarely show up in a scan but are trivial to exploit once found.
Beyond authorisation we examine the practical weaknesses that production APIs develop: mass assignment that lets a request set fields it should not, missing rate limits that enable enumeration and credential stuffing, injection reachable through parameters, and GraphQL queries that can be nested or batched into a denial of service. We work from your OpenAPI or GraphQL schema where you have one, and from captured traffic where you do not.
Reporting is built for the people who own the service. Each finding names the endpoint and method, shows the request and response that prove it, scores the risk with CVSS v4.0, and recommends a fix at the right layer, whether that is a gateway policy, a code change or a schema constraint. We confirm every issue by hand so your engineers never chase a false positive.
How we work with UK clients
- Testing windows set in UK time at scoping. India runs 4.5 hours ahead during British Summer Time and 5.5 hours ahead in winter, so our days overlap.
- Fixed proposals in GBP, excluding VAT; the reverse charge usually applies to UK business buyers.
- No traffic leaves our hands until written authorisation is signed by someone entitled to give it, as the Computer Misuse Act 1990 requires.
- Findings labelled for the evidence you file: ISO 27001 Annex A, UK GDPR Article 32, PCI DSS or a supplier questionnaire.
What's included
Our approach
- Specification reviewWe ingest your schema or capture traffic to enumerate every route and parameter.
- Token mappingWe obtain tokens for each role so authorisation can be tested in every direction.
- Manual testingTesters exercise each endpoint for access, logic, injection and resource flaws.
- ChainingIndividual weaknesses are combined into realistic data-access and takeover paths.
- Report & debriefWe deliver evidence-backed findings and brief your engineers on fixes.
What you receive
- Endpoint inventory tested against the API Security Top 10
- Risk-rated findings with request and response evidence
- CVSS v4.0 scores and remediation per endpoint
- Guidance on gateway, schema and code-level fixes
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- OWASP API Security Top 10
- OWASP WSTG
- OWASP ASVS
- PTES
- NIST SP 800-115
- CVSS v4.0
- CWE
- UK GDPR Art. 32
Frequently asked questions
Can you test an API without documentation?
Yes. A schema speeds things up, but we can enumerate an API from captured traffic, a proxy export or a client application. Giving us whatever you have, even a partial collection of requests, lets us spend more of the engagement on testing and less on discovery.
Do you test GraphQL differently from REST?
The logic and authorisation questions are the same, but GraphQL adds introspection, deeply nested queries and batching that can expose data or exhaust resources. We test those specific behaviours alongside the standard object- and function-level authorisation checks.
How do you avoid corrupting our data?
We prefer a staging environment seeded with test data. Where we must use production we agree boundaries first, favour read operations, and label any records we create so your team can remove them. Destructive calls are only run with explicit written approval.
Can testing run during UK office hours?
Yes. Testing windows are agreed in UK time at scoping. India is 4.5 hours ahead of the UK during British Summer Time and 5.5 hours ahead in winter, so our working day overlaps yours. If you prefer quiet periods, we can also test in your early morning or evening.
Does an application pentest help with UK GDPR?
It can. Article 32 of the UK GDPR expects "a process for regularly testing, assessing and evaluating the effectiveness" of security measures. A dated application test with retested fixes is a clear record of that process for the personal data your application handles.