API Security Testing — Automated Checks Across 5 OWASP API Categories
Your API answers to the whole internet. We check what it gives away.
An automated, unauthenticated scan of a REST API's public surface — plus GraphQL introspection detection. Five of the ten OWASP API categories are implemented.
What the scan tests
Automated checks against the public surface of a REST API — and a plain list of the categories we have not built.
Spec & Path Probing
We parse an OpenAPI or Swagger spec if you give us the URL, and probe a fixed list of common documentation and API paths. This is path probing, not crawling or fuzzing — undocumented endpoints outside that list will not be found.
Authentication Checks (API2)
Unauthenticated access to common protected paths, APIs that accept an invalid JWT, API keys accepted in query parameters, CORS preflight reflecting arbitrary origins, and endpoints your spec declares with no security requirement.
Misconfiguration & TLS (API8)
Wildcard CORS, wildcard CORS with credentials, missing X-Content-Type-Options and X-Frame-Options, server and X-Powered-By version disclosure, API served over HTTP, missing or short HSTS, stack traces and database errors in responses.
Resource Consumption (API4)
A small five-request burst and rate-limit header inspection, plus oversized-payload, malformed-JSON and content-type handling. It detects the absence of any throttling signal — it does not measure your limit under real load.
Inventory & Exposure (API9)
Publicly exposed API documentation, health and status endpoints leaking infrastructure detail, directory listings, sensitive paths reachable without auth, and GraphQL introspection left enabled.
Planned: authorization testing
Planned, not built: object-level and function-level authorization (BOLA, BFLA), object property level authorization, sensitive business flows, SSRF and unsafe consumption of third-party APIs. There is also no injection testing and no PII classification in this scanner.
OWASP API Top 10 — category by category
Four categories are automated, one is partially covered, five are not built. This list is generated from what the scanner actually emits.
One check only — sensitive paths reachable without auth. Not object-level authorization testing.
Unauthenticated access, invalid-JWT acceptance, keys in query parameters.
Not implemented.
Rate-limit signals, oversized payloads, malformed input handling.
Not implemented.
Not implemented.
Not implemented. The scanner blocks SSRF against itself; that is a safeguard, not a test we run on you.
CORS, security headers, TLS and HSTS, version disclosure, error leakage.
Exposed docs, health endpoints, directory listings, GraphQL introspection.
Not implemented.
Category list: OWASP API Security Top 10, 2023 edition. Coverage status: Bachao.AI, as at September 2026.
Not packaged yet
API Security is still being built, so there is no plan to sell you and no tier list worth printing. If it is close to what you need, talk to us — we will scope the work, tell you plainly what exists today, and quote only for that.
Request a Quote — API Security
Tell us a bit about what you need scoped. Shouvik will review your details and reach out within 24 hours.
Explore more products
Bachao.AI covers your entire security surface — from code to cloud to compliance.
- Certified
- Certified
- Accredited
- In process
- GDPRIn process
Every API is an attack surface
Book a free scan of your API's public surface. It covers five of the ten OWASP API categories — we will tell you what it found and what it never looked at.