Service
API securitytesting
The API is tested as part of the product, with the same written scope and the same rule: unpublished tool output is not a customer finding.
01
Object access
Whether an identifier for one customer, order, or record can be used by another account.
02
Function access
Whether administrative or privileged actions are enforced on the server for every role in scope.
03
Authentication
API keys, session cookies, OAuth or OIDC, and what happens when a token is missing, expired, or belongs to someone else.
04
Data exposure
Fields returned to the client that the role should not see, including errors and debug output.
05
GraphQL or REST shape
The quotation records which style is in scope and, when you know it, how many operations or endpoints are included.
06
What we need from you
A staging base URL, the auth method, test accounts after approval, and an OpenAPI or Postman file if you have one.
Credentials stay off the public form
Do not send live tokens on the request form. Test accounts are shared through the channel named in the rules of engagement.
Ready to request a test?
Share the application and the reason. We reply in writing. No call is required.