API security review: start with the calls the UI already makes
An API security review for a product team starts with the endpoints the page already calls — missing auth, object access, uploads, and exports.
An API security review that starts from a 400-endpoint spec and never opens the product is homework.
I start where your user starts: the page, the token, the call the network panel already shows.
Short answer: API work is included in the web application security review of one app — $2,400, $1,200 to start, 48 hours after access.
What I exercise
The JSON the dashboard already fetches. The export the admin button already hits. The upload the form already posts. The neighbor route that forgot a check.
I do not drop exploit payloads into the report. The sample shows how an API finding is written: ID, severity, path, fix.
Standalone API-only programs with no UI are quoted if the surface is a different product.
See pricing.
FAQ
What is in an API security review? +
Authenticated calls the UI already makes, plus obvious neighbors: missing auth, IDOR-style object access, upload and download controls.
Do you need the OpenAPI file? +
Nice to have. Not required. I follow the browser.
Is source included? +
No. Source-code audit is a separate quote. One live app is $2,400.
