2.02Application security

API Security Testing

Manual testing of REST, GraphQL and gRPC APIs against the OWASP API Security Top 10, with emphasis on object- and function-level authorisation and multi-step abuse cases.

Book a consultation+371 2256 5353

API vulnerabilities often depend on identity, object ownership, state and workflow logic and therefore cannot be found reliably by automated scanning alone. We review the API specification and test authentication, authorisation, object identifiers, input handling, rate limits and business processes across REST, GraphQL and gRPC.

Coverage includes the OWASP API Security Top 10, such as BOLA, BFLA, broken authentication, mass assignment, SSRF, excessive data exposure and unrestricted resource consumption. Confirmed abuse cases can be converted into regression tests, and fixes are re-tested.

OWASP API Top 10
every risk tested, API1–API10
BOLA
the #1 API risk – and the one scanners miss

How it works

  1. 01

    Scoping & discovery

    Inventory endpoints from OpenAPI/GraphQL specs, traffic and source; map authentication, roles and trust boundaries.

  2. 02

    Automated baseline

    Schema-aware scanning and fuzzing to clear known issues and surface candidates for manual testing.

  3. 03

    Manual exploitation

    Business-logic, BOLA/BFLA, auth-bypass, mass-assignment and SSRF testing with chained, multi-identity exploits.

  4. 04

    Reporting & enablement

    Exploitability-ranked findings with proof of impact, remediation guidance and developer walkthrough.

  5. 05

    CI regression & retest

    Wire abuse cases into the pipeline as regression tests and re-test remediated code to confirm closure (optional).

Packages

Essential
Focused test of a single critical API or service against the OWASP API Top 10.
ComprehensivePopular
Full API estate testing with business-logic depth and CI-integrated regression tests.
Enterprise
Ongoing API security programme with continuous testing and developer enablement.

Frequently asked questions

A web-application test includes the browser-facing application, while a dedicated API assessment concentrates on REST, GraphQL or gRPC interfaces and their authentication, authorisation, data handling and business logic. We use available schemas and test different roles, object access and multi-step workflows that may not be reachable through the user interface. The two scopes can be combined where the application and API form one attack surface.

Helpful tools

Credited findings

Public disclosures and field research where this work produced citable, verifiable results.

SeverityFindingAdvisoryYear
5.8MediumAuthorization bypass in 8x8’s JaaS SIP calling gatewayJitsi as a Service (JaaS) – 8x8 SIP gateway2026

What clients in your sector say

From organisations in the same sector.

SaaS
“Instead of slowing us down, they seamlessly integrate with our fast-moving engineering team, providing proactive, high-level insights that let us fortify our systems in real time as we grow.”

Karlis Broders

CTO · Trace.Space

E-commerce
“Their structured methodology, clear communication, and actionable insights directly contributed to increased system reliability, scalability, and resilience.”

Oskars Podziņš

Head of Information Security · Printful

IT services
“What stands out is their practical approach – no fluff, just clear findings and actionable recommendations.”

Viktors Trifanovs

CISO · TestDevLab

All services

Scope a test

support@offseq.com+371 2256 5353

Direct access to a senior specialist · Reply within 24 hours · NDA available on request

Scope a testGet in touch