Question 1

Do you test REST and GraphQL, or only REST?

Accepted Answer

Both. There is a dedicated REST API scanner and a separate GraphQL scanner, alongside JWT and OAuth checks for token-based auth. The right combination is chosen from your endpoint inventory.

Question 2

What are BOLA and BFLA, and do you check for them?

Accepted Answer

BOLA (Broken Object Level Authorization) is when a user can read or change another user’s object by changing an ID; BFLA (Broken Function Level Authorization) is reaching an admin-only function as a normal user. The authz-matrix scanner replays requests across roles specifically to surface both.

Question 3

How much does API penetration testing cost?

Accepted Answer

API engagements in India generally price in the same band as a focused web application penetration test — typically ₹1.5–4 lakh (USD 2,000–5,000) — while combined network + web VAPT for a mid-size environment runs ₹5–15 lakh (USD 6,000–18,000). Infronest engagements start at ₹36,750 per application per year, or ₹42,000 one-time; pricing context lives on the VAPT hub.

Question 4

How long does an API security assessment take?

Accepted Answer

With a spec supplied, a scoped API assessment typically completes in one to two weeks including human verification — industry-typical, not a promise for every scope. Without a spec, discovery adds time; very large endpoint inventories trend toward the one-to-three-week range of a full web test.

Question 5

Do I need to provide an OpenAPI or Swagger spec?

Accepted Answer

It helps but is not mandatory. With a spec, coverage is precise; without one, the discovery scanner probes common REST and GraphQL paths. Providing the spec is the fastest way to get complete coverage.

Question 6

How do you test authorisation differences between roles?

Accepted Answer

You supply sessions for the roles you care about, and the authz-matrix scanner sends the same requests under each — including an unauthenticated pass — so a 200 where a 403 was expected exposes a vertical or horizontal privilege-escalation gap.

Question 7

Will the API tests send destructive or bulk-write requests?

Accepted Answer

Testing stays within the engagement allowlist and favours read and safe-method probing. Anything with write or destructive potential is agreed in scope first — you should always test against a staging environment or with explicit written authorisation for production.

API penetration testing for REST, GraphQL & microservices

What are BOLA and BFLA, and do you check for them?

Already live in the product

Included in the Infronest workspace

What you get

What teams can do here

How it works

Discover the surface

Map the auth roles

Run the API and authz checks

Verify and report

A worked example

Frequently asked questions

Find the BOLA before a customer does

API penetration testing for REST, GraphQL & microservices

What are BOLA and BFLA, and do you check for them?

Already live in the product

Included in the Infronest workspace

What you get

What teams can do here

How it works

Discover the surface

Map the auth roles

Run the API and authz checks

Verify and report

A worked example

Frequently asked questions

All VAPT services

Web application vulnerability assessment & penetration testing

Mobile application security testing (APK / IPA)

Network penetration testing, internal and external

Cloud penetration testing for AWS, Azure and GCP

Continuous security scanning on every commit and deploy

Remediation support and retests that prove fixes held

Explore connected offerings

Web application vulnerability assessment & penetration testing

Continuous security scanning on every commit and deploy

Git governance, access, repository, and security views

Find the BOLA before a customer does