- Home
- API Security Testing Software
- Pentestas API Scanner
On the recordRead 2 Oct 202612 facts
Pentestas API Scanner
Plans and prices
Starter
$948a year
5 scans per month · 1 verified domain · web vulnerability scanning · OWASP Top 10
Read 2 Oct 2026 · pentestas.com
Professional
$2,988a year
Unlimited scans · 5 verified domains · API penetration testing · authenticated scanning
Read 2 Oct 2026 · pentestas.com
Business
$5,988a year
Unlimited scans · 15 verified domains · AI exploitation engine · mobile app pentesting
Read 2 Oct 2026 · pentestas.com
Enterprise
Priced on request
Unlimited verified domains · custom integrations and on-premise · dedicated security team
Read 2 Oct 2026 · pentestas.com
On the record
- Authorization checks
- The tool runs BOLA and BFLA probes for broken object-level and function-level authorization.pentestas.com · read 2 Oct 2026
- Automated checks
- Its automated checks include authentication, authorization, mass assignment, injection, and JWT-signing checks.pentestas.com · read 2 Oct 2026
- Free usage limit
- The free tier allows two runs per tool per IP per day, and the page says it does not keep history.pentestas.com · read 2 Oct 2026
- GraphQL limit
- GraphQL is not covered on this page; Pentestas directs users to its separate GraphQL Scanner.pentestas.com · read 2 Oct 2026
- Integrations
- The page says results can be fed into SIEM, ticketing systems, or CI/CD pipelines through the REST API.pentestas.com · read 2 Oct 2026
- JWT checks
- JWT checks include alg=none, weak HS256 secrets, kid injection, missing exp/iss/aud, and signature stripping.pentestas.com · read 2 Oct 2026
- OpenAPI analysis
- The OpenAPI/Swagger parser flags endpoints without authentication, overly broad scopes, undocumented response codes, and missing rate limits.pentestas.com · read 2 Oct 2026
- Protocols
- The scanner covers REST and SOAP requests using GET, POST, PUT, PATCH, and DELETE with authentication variants and common injection payloads.pentestas.com · read 2 Oct 2026
- Purpose
- API Scanner scans live APIs, analyzes Swagger/OpenAPI specifications, and decodes JWTs to inspect claims and signature weaknesses.pentestas.com · read 2 Oct 2026
- Results
- Findings are grouped by endpoint or claim with severity and a one-line remediation; reports can be exported as PDF, CSV, or JSON.pentestas.com · read 2 Oct 2026
- Security and privacy
- Pentestas says scan data is encrypted at rest and in transit, and users control data retention and export.pentestas.com · read 2 Oct 2026
- Support
- The pricing page lists email support for Starter, priority chat for Professional, and phone support with SLA guarantees for Business.pentestas.com · read 2 Oct 2026
