- Home
- API Security Testing Software
- Pentest-Tools.com API Scanner
Pentest-Tools.com API Scanner
Bucharest, Romania, Europe
What it is
Pentest-Tools.com API Scanner is an online service for assessing APIs and identifying vulnerabilities such as SQL injection, SSRF, local file inclusion, code injection, and request URL override. It supports REST and GraphQL APIs, as well as Postman Collections, and accepts OpenAPI 2 and 3 specifications in YAML, YML, or JSON. Authenticated scans can use request headers, including Basic Authorization and JWT tokens. Reports include risk summaries, vulnerability evidence, remediation advice, and a list of more than 40 tests. Export options depend on the plan and can include PDF, HTML, CSV, XLSX, or editable DOCX. The platform lists integrations such as Jira, Slack, Microsoft Teams, Discord, webhooks, and GitHub Actions. A free plan is available; paid plans start at $95 per month, with API scanning limited in NetSec and included in WebNetSec. The seven-day full-scanner trial requires a business email and card and costs nothing if canceled before day eight.
For and against
For
- Supports REST, GraphQL, and Postman Collections
- Accepts OpenAPI 2 and 3 specifications
- Authenticated scans support Basic Authorization and JWT
- Reports include evidence and remediation advice
- Offers a free plan
Against
- NetSec includes only limited API scanning
- Trial requires a business email and card
- Trial must be canceled before day eight to avoid cost
The verdict
The scanner supports several API formats and authenticated assessments, with reports that include evidence and remediation guidance. Check plan limits before choosing: full API scanning is included in WebNetSec, while NetSec offers limited API scanning.
Who it suits
The scanner is aimed at offensive and defensive security teams, penetration testers, and system builders or administrators assessing APIs.
Plans and prices
NetSec
Network scanning · cloud scanning · password auditing · reconnaissance
Read 29 Sep 2026 · pentest-tools.com
WebNetSec
Everything in NetSec · DAST · authenticated web scans · REST and GraphQL API scanning
Read 29 Sep 2026 · pentest-tools.com
Pentest Suite
Everything in WebNetSec · automated CVE exploitation · SQL injection and XSS exploiters · pentest report generator
Read 29 Sep 2026 · pentest-tools.com
On the record
- Authentication
- Authenticated scans can use request headers with methods including Basic Authorization and JWT tokens.pentest-tools.com · read 29 Sep 2026
- Data protection
- The company says customer data is encrypted at rest with AES-256 and in transit with TLS 1.2+, and reports are automatically deleted 30 days after generation.pentest-tools.com · read 29 Sep 2026
- Hosting and residency
- The product runs in Hetzner and Linode data centers in the EU, UK, Iceland, and US; new customers can choose US or Europe data hosting.pentest-tools.com · read 29 Sep 2026
- Integrations
- The platform lists Jira, Slack, Microsoft Teams, Discord, webhooks, Nucleus, Vanta, Burp Suite, AWS, Azure Marketplace, GitHub Actions, and a REST API among its integrations.pentest-tools.com · read 29 Sep 2026
- Intended users
- The company describes its tools as made for penetration testers and other information security professionals, and the API scanner page names offensive and defensive security teams and system builders or administrators as users.pentest-tools.com · read 29 Sep 2026
- Plan limits
- Pricing states that API scanning is limited in NetSec and included in WebNetSec, while all plans include API access and unlimited scans on assets.pentest-tools.com · read 29 Sep 2026
- Purpose
- The online API Vulnerability Scanner assesses APIs and detects vulnerabilities including SQL injection, SSRF, local file inclusion, code injection, and request URL override.pentest-tools.com · read 29 Sep 2026
- Reports
- Reports include risk summaries, vulnerability evidence, remediation advice, and a list of 40+ tests; exports vary by plan and include PDF, HTML, CSV, XLSX, or editable DOCX.pentest-tools.com · read 29 Sep 2026
- Security certification and privacy
- PentestTools SA says it is certified to ISO/IEC 27001:2023 and processes customer data under GDPR.pentest-tools.com · read 29 Sep 2026
- Specification support
- It supports OpenAPI versions 2 and 3 in YAML, YML, and JSON formats.pentest-tools.com · read 29 Sep 2026
- Supported APIs
- The scanner works on REST APIs, GraphQL APIs, and Postman Collections.pentest-tools.com · read 29 Sep 2026
- Trial terms
- The full scanner trial lasts 7 days, requires a business email and card, and costs nothing if canceled before day 8.pentest-tools.com · read 29 Sep 2026
