FalehSec
WHERE YOUR BUSINESS LOGIC LIVES

API Security Testing for REST & GraphQL

If your mobile app, integrations, or modern backend run on APIs, that is exactly where BOLA/IDOR, broken authentication, and excessive data exposure are found — and where a breach hurts most. FalehSec tests your APIs the way attackers actually abuse them.

Request an API Test Estimate the Price
What's tested

Deep testing, not just a scan

Automated API scanners miss authorization logic — the most common and most serious API failures. Every test is performed manually, tailored to your API design.

BOLA / IDORCan a user read or modify another user's objects through the API? The #1 API vulnerability.
Broken authenticationSession and token handling, missing validation, weak auth flows.
Excessive data exposureAPIs returning more fields than the client needs — leaking sensitive data silently.
Mass assignmentCan attackers bind extra request fields, like changing their own role to admin?
Business logic abuseFlaws specific to your workflows — limits, pricing, state, and trust boundaries.
GraphQL-specificIntrospection exposure, batching abuse, over-fetching and authorization gaps.
Process & pricing

Fixed quote, clear timeline, retest included

  1. Free scoping call — 30 minutes to map your API surface, goals, and off-limits areas. Fixed quote and timeline before any work begins.
  2. Mapping & targeted testing — manual and structured testing against the agreed scope with progress updates.
  3. Report & prioritisation — findings ranked by business risk with reproduction steps and proof-of-concept evidence.
  4. Retest & closure — fixes verified after remediation, with no regressions.
AssessmentStarting priceTypical timeline
API Security Testing (REST / GraphQL)SAR 5,5003–6 working days
Web Application Pentest (API + frontend)SAR 7,5004–10 working days
Retest & remediation verification30% of original (from SAR 2,500)Within 3 months

Prices are estimated starting points — final quotes are confirmed after the free scoping call. VAT not included.

See what the deliverable looks like

Preview a sample penetration test report before you commit — illustrative, with fictional client data.

View Sample Report
FAQ

Common questions, straight answers

What does API security testing cover?

Deep testing of REST and GraphQL APIs for BOLA/IDOR, broken authentication, excessive data exposure, mass assignment, and business logic abuse specific to your API design.

When does a business need API security testing?

When your business logic lives in APIs — mobile apps, integrations, or modern backends — because that is where BOLA/IDOR and broken authentication flaws are most often found and most damaging.

Do you sign an NDA and define rules of engagement?

Yes. An NDA is signed before testing begins, and a rules-of-engagement document defines scope, testing windows and authorised techniques before any testing starts.

Is a retest included?

Yes. After your team applies fixes, every finding is retested to confirm it is resolved and no regressions were introduced.

Ready to test your APIs?

Start with a free, no-obligation scoping call — Mohammed replies within 24 hours, often much faster on WhatsApp.

Chat on WhatsApp +966 56 215 5628