- Home
- API Security Software
- apPosture API Security
apPosture API Security
Baku, Azerbaijan
What it is
apPosture API Security inventories API endpoints and helps teams prioritize risks by combining public exposure, sensitive data, and authentication status into a single verdict. Endpoint labels show whether findings are linked to source code and runtime observations, source code alone, or runtime alone. Discovery uses SAST attack-maps, DAST crawling, an attached OpenAPI specification, and external subdomain probing. Listed coverage includes OpenAPI import, GraphQL, gRPC, HTTP/2, h2c, and REST. Teams can compare an OpenAPI specification with running endpoints to identify documented, shadow, declared-untested, and authentication-drift states. Runtime correlation ingests existing access logs out of band rather than inline with requests. The product offers API-scoped compliance across seven frameworks and SARIF export. Deployment options include self-hosted, customer-cloud, and dedicated managed instances; self-hosted use relies on a local LLM and needs no outbound connection after setup. Pricing states no free tier, includes a 30-day proof of concept, and starts at $35/mo (annual).
For and against
For
- Compares OpenAPI specifications with running endpoints.
- Covers GraphQL, gRPC, HTTP/2, h2c, and REST.
- Correlates runtime data from existing access logs.
- Supports self-hosting with a local LLM.
Against
- No free tier is listed.
- Runtime protection is listed as unavailable.
- Included scan targets: 0 targets.
The verdict
apPosture API Security combines endpoint discovery, risk prioritization, and contract comparison with multiple deployment choices. Pricing and included scan-target limits are important to clarify before choosing an edition.
Who it suits
It suits teams that need API discovery, risk prioritization, specification checks, and API-scoped compliance. Self-hosting is an option for organizations that want deployment in their own environment.
Plans and prices
API Security add-on
OWASP API Top 10 · schema drift · runtime inventory; included on Platform+
Read 15 Oct 2026 · apposture.com
Essentials
SAST · SCA · Secrets · IaC
Read 15 Oct 2026 · apposture.com
Platform
Everything in Essentials · 5 DAST target URLs · API security · cloud posture
Read 15 Oct 2026 · apposture.com
Enterprise
Everything in Platform · 10 target URLs with Agentic Pentest · STRIDE threat modeling · RBAC and multi-tenant
Read 15 Oct 2026 · apposture.com
Agentic Pentest uplift
Hypothesis generation and agentic exploitation on an existing dynamic-testing target
Read 15 Oct 2026 · apposture.com
One-off engagement
Dynamic testing plus Agentic Pentest and full report
Read 15 Oct 2026 · apposture.com
DAST target URL
Crawl · active scan · deterministic proof; 5 URLs included on Platform and 10 on Enterprise
Read 15 Oct 2026 · apposture.com
On the record
- Air-gapped operation
- The platform is designed to run offline with a local model, no required telemetry and no required outbound connection.apposture.com · read 15 Oct 2026
- API authentication
- Programmatic access uses scoped, revocable bearer tokens with the apt_ prefix; browser sessions use JWTs and MFA.docs.aspm.apposture.com · read 15 Oct 2026
- API CI controls
- API findings can enforce a CI score gate, export SARIF and map to seven compliance frameworks.apposture.com · read 15 Oct 2026
- API discovery sources
- Endpoint discovery uses SAST attack maps, DAST crawls, attached OpenAPI specifications and external subdomain probing.apposture.com · read 15 Oct 2026
- API inventory
- API Security inventories endpoints and assigns each a single A-F risk grade.apposture.com · read 15 Oct 2026
- CI/CD integrations
- CI/CD gating supports GitHub, GitLab, Jenkins, Azure DevOps and Bitbucket, with Monitor-to-Block operation.apposture.com · read 15 Oct 2026
- Code and runtime
- Endpoints are labeled Code + Runtime, From source, or Runtime-only to show code-to-runtime provenance.apposture.com · read 7 Oct 2026
- Code-to-runtime
- Endpoints are labelled as Code plus Runtime, source-only or runtime-only to expose shadow APIs.apposture.com · read 15 Oct 2026
- Compliance
- API Security offers API-scoped compliance across seven frameworks and supports SARIF export.apposture.com · read 7 Oct 2026
- Compliance mapping
- Findings are mapped to OWASP Top 10, PCI-DSS v4, ISO 27001, SOC 2, NIST 800-53, HIPAA and GDPR.apposture.com · read 15 Oct 2026
- Contract comparison
- Users can attach an OpenAPI specification and compare declared endpoints with running traffic for documented, shadow, declared-untested and auth-drift states.apposture.com · read 15 Oct 2026
- Contract diff
- An attached OpenAPI specification can be diffed against running endpoints to surface documented, shadow, declared-untested, and auth-drift states.apposture.com · read 7 Oct 2026
- Data handling
- In self-hosted and customer-cloud deployments, apPosture says it never receives source code, scan data or findings.apposture.com · read 15 Oct 2026
- Deployment
- Deployments run self-hosted through Docker Compose, in the customer’s cloud account or as a dedicated managed instance.apposture.com · read 15 Oct 2026
- Deployment and privacy
- The platform can run self-hosted, in the customer's cloud, or as a dedicated managed instance; self-hosted deployment uses a local LLM and does not require outbound connections after setup.apposture.com · read 7 Oct 2026
- Discovery
- Endpoint discovery draws on SAST attack-maps, DAST crawling, an attached OpenAPI specification, and external subdomain probing.apposture.com · read 7 Oct 2026
- Documentation depth
- The documentation includes quick start, installation, platform architecture, API Security, CI/CD, governance, reporting, administration and troubleshooting sections.docs.aspm.apposture.com · read 15 Oct 2026
- Integrations
- Supported source-control connections include GitHub, GitHub Enterprise, GitLab, GitLab self-managed, Bitbucket and Azure DevOps.apposture.com · read 15 Oct 2026
