Overview
UK fintechs, open banking providers and SaaS platforms expose more through APIs than through their user interfaces. We test object-level authorisation, token handling and partner integrations, which are the issues behind many serious API data leaks.
Modern products are API-first: your web app, mobile apps and partner integrations all talk to the same backend. Attackers know this — once they understand your API, they skip the user interface entirely and call endpoints directly.
The most damaging API flaws are authorisation failures: changing an ID to read another customer's invoice, calling an admin-only function as a normal user, or setting a hidden field like role or price through mass assignment. Scanners can't judge who should see what. Our testers can.
We work from your OpenAPI/Swagger specification, Postman collections or GraphQL schema, plus traffic captured from your clients, to make sure every endpoint and method is covered — including old versions you may have forgotten are still live.
How testing works for UK organisations
- Signed scope and written authorisation before any testing, in line with the Computer Misuse Act 1990
- Testing windows agreed in UK time, including out-of-hours windows for production systems
- Fully remote delivery, with internal and wireless access via VPN or a posted test device, so there are no travel costs
- Reports mapped to ISO 27001, PCI DSS, UK GDPR Article 32 and customer questionnaires, with a fixed price in GBP
What's included
Our approach
- Specification reviewWe ingest your API definitions and map endpoints, methods, roles and data objects.
- Traffic analysisWe capture real client traffic to discover undocumented endpoints and parameters.
- Authorization matrix testingEvery sensitive endpoint is tested across roles and, for SaaS, across tenants.
- Input & logic testingInjection, deserialization, rate-limit bypass and business-flow abuse.
- Reporting & retestRequest/response evidence, root-cause fixes and verification after remediation.
What you receive
- Endpoint coverage list
- Findings mapped to OWASP API Security Top 10 (2023)
- Reproducible requests (cURL/Postman) per finding
- Authorization design recommendations
- Retest report and attestation letter
Standards & frameworks
- OWASP API Security Top 10
- OWASP WSTG
- OWASP ASVS
- CWE
- SOC 2
- PCI DSS
- NCSC penetration testing guidance
Frequently asked questions
Do you need API documentation?
It is strongly recommended. Specifications and Postman collections let us spend paid time testing instead of discovering endpoints.
Can you test GraphQL APIs?
Yes — including introspection exposure, field-level authorisation, query depth and complexity limits, and batching or aliasing abuse.
Do you test internal or partner APIs?
Yes, if they are in scope. Internal APIs often assume callers are trusted, which makes them valuable targets after an initial compromise.
Are you CREST or CHECK accredited?
We don't claim CREST or NCSC CHECK status on this site. Most private-sector tests, including those for ISO 27001, PCI DSS and customer due diligence, don't require either. If a contract, public-sector buyer or regulator specifically requires a CHECK or CREST-accredited provider, tell us at scoping and we'll tell you honestly whether we can meet it. See our CREST and CHECK guide.
Do you quote in pounds sterling?
Yes. UK proposals are fixed-price and quoted in GBP. Prices exclude VAT where VAT applies to cross-border services. We confirm the treatment for your organisation in the proposal.