Overview
A large share of India's digital economy is API traffic between partners: payment aggregators, lenders, KYC vendors, logistics firms and marketplaces. Each integration is an agreement about who may ask for what, and those agreements are often enforced only in the client. We test your APIs from both sides, holding a token for every role and partner, and back each weakness with the exact request and response that prove it.
An API exposes data and actions directly, which is why authorisation is where most of them break. We test whether one user can read or change another user's objects by altering an identifier, whether a standard account can reach administrative functions, and whether endpoints return more fields than the client ever requested. These object- and function-level flaws rarely show up in a scan but are trivial to exploit once found.
Beyond authorisation we examine the practical weaknesses that production APIs develop: mass assignment that lets a request set fields it should not, missing rate limits that enable enumeration and credential stuffing, injection reachable through parameters, and GraphQL queries that can be nested or batched into a denial of service. We work from your OpenAPI or GraphQL schema where you have one, and from captured traffic where you do not.
Reporting is built for the people who own the service. Each finding names the endpoint and method, shows the request and response that prove it, scores the risk with CVSS v4.0, and recommends a fix at the right layer, whether that is a gateway policy, a code change or a schema constraint. We confirm every issue by hand so your engineers never chase a false positive.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- Specification reviewWe ingest your schema or capture traffic to enumerate every route and parameter.
- Token mappingWe obtain tokens for each role so authorisation can be tested in every direction.
- Manual testingTesters exercise each endpoint for access, logic, injection and resource flaws.
- ChainingIndividual weaknesses are combined into realistic data-access and takeover paths.
- Report & debriefWe deliver evidence-backed findings and brief your engineers on fixes.
What you receive
- Endpoint inventory tested against the API Security Top 10
- Risk-rated findings with request and response evidence
- CVSS v4.0 scores and remediation per endpoint
- Guidance on gateway, schema and code-level fixes
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- OWASP API Security Top 10
- OWASP WSTG
- OWASP ASVS
- PTES
- NIST SP 800-115
- CVSS v4.0
- CWE
- DPDP Act 2023
- RBI IT Governance Direction 2023
Frequently asked questions
Can you test an API without documentation?
Yes. A schema speeds things up, but we can enumerate an API from captured traffic, a proxy export or a client application. Giving us whatever you have, even a partial collection of requests, lets us spend more of the engagement on testing and less on discovery.
Do you test GraphQL differently from REST?
The logic and authorisation questions are the same, but GraphQL adds introspection, deeply nested queries and batching that can expose data or exhaust resources. We test those specific behaviours alongside the standard object- and function-level authorisation checks.
How do you avoid corrupting our data?
We prefer a staging environment seeded with test data. Where we must use production we agree boundaries first, favour read operations, and label any records we create so your team can remove them. Destructive calls are only run with explicit written approval.
Do you quote in rupees, and is GST extra?
Yes to both. Proposals are fixed-price in INR, and 18% GST is added on the invoice. The figure covers testing, the report, a debrief call and a retest of the findings you fix.
Can this report go to our RBI or SEBI auditor?
Reports show scope, dates, method, CVSS-rated findings and closure status, which is what auditors normally look for. If a regulator or contract insists on a CERT-In empanelled auditor, note that we do not claim empanelment; raise it when we scope the work and you will get a clear yes or no on whether we can meet it.