API penetration testing
Your API is where the money moves, and it is where most authorization bugs live. Notra probes your REST/JSON surface endpoint by endpoint, verifies what it finds with harmless proofs, and ships each finding with the exact request and response. Deep Audit is $149 flat.
How the API run works
1 · Map
The agent crawls the app and follows the calls it makes, discovering JSON endpoints and inferring the request contract: methods, parameters, auth headers, error shapes.
2 · Probe
It replays and mutates requests to test endpoint authorization, mass-assignable fields, and injection in JSON bodies — inside a fixed, manifest-pinned budget.
3 · Gate
Every candidate is re-proven with a harmless PoC; under 0.8 confidence it never ships. Authorization findings especially are re-run from the unauthenticated side.
4 · Evidence
Each surviving finding ships its exhibit — the exact request that succeeded and the response that mattered — plus the fix in plain English.
What the API audit covers
The classic failure: an endpoint that checks that you're logged in but not who you are. The agent replays requests with tokens stripped, downgraded, and swapped to see what the server lets through — and proves it either way.
Probes for fields the server accepts but never intended — an extra role or price key in a JSON body — plus injection payloads in JSON parameters, each verified with a harmless proof-of-exploit before it counts as a finding.
Honest scope: today the agent builds its picture of your API by crawling and probing the live surface, not by reading an OpenAPI file. Deeper spec-driven fuzzing is on the roadmap — early access partners get to steer it.
Everything the audit reports is packaged for humans and machines alike: the sample report shows the exhibit format, and the REST API lets you pull findings straight into your issue tracker.
Questions engineering teams ask
Can you drive the audit from my OpenAPI spec?
Not yet. Today the agent discovers your API by crawling the application and probing the JSON endpoints it finds — which covers what is actually reachable. Spec-file-driven fuzzing (deep coverage of every schema-defined parameter) is on the roadmap; if that is the shape you need, join the early-access program and steer it.
How do you avoid mutating my data?
Probes use harmless proof-of-concept payloads and the same read-first discipline as the web audit: prove the flaw fires, don't wreck the record. The run is manifest-pinned, so you can audit every request afterward.
Do you cover GraphQL or event-driven APIs?
The strongest, most battle-tested coverage today is REST/JSON over HTTP. GraphQL introspection gaps show up when they are reachable, but this is not a GraphQL-specialist tool — if that is your main surface, treat Notra as one layer, not the whole answer.
The free scorecard takes about a minute and flags the obvious exposure — then decide if the $149 audit is warranted.
Related: the API documentation for wiring results into your tooling, the sample verified report for the evidence format, and early access if spec-driven fuzzing is what your team needs next.