Gray-Box API Penetration Test.

Authentication and session handling across every documented role.

Object-level and function-level authorization, including IDOR and broken role boundaries.

Input validation, mass assignment, and injection paths.

Rate-limiting, throttling, and abuse resistance on enumerated endpoints.

Webhook authenticity, signature verification, and replay protection where webhooks are in scope.

Misconfiguration of the gateway, transport, and CORS where applicable.

Per-role test credentials covering each authorization tier in the API.

OpenAPI / GraphQL schema, Postman collection, or equivalent endpoint inventory.

Architecture context: hosting, gateway, authentication provider, and any shared services.

Authorization to test (signed Authorization to Test before any traffic is sent).

Stakeholder contact for emergency-stop and credential rotation.

Pre-engagement intake captures scope, environments, and emergency-stop rules.

Mutual non-disclosure agreement is signed before any sensitive scope crosses.

Statement of Work, Authorization to Test, and Rules of Engagement are countersigned.

Active testing runs against a non-production or production environment per the agreed scope.

Findings are validated manually before any severity is assigned.

Report is reviewed against a defensibility checklist before delivery.

Remediation verification (retest) is offered as a separate engagement.

Executive summary describing scope, methodology, and the disposition of findings.

Per-finding write-up with reproduction steps, evidence, severity, and specific remediation guidance.

Manifest of tools, queries, and scripts used during testing, with version stamps.

Evidence pack suitable for marketplace and vendor-questionnaire review when applicable.

Retest letter format provided in advance so remediation work can target it.

We will not say the API is secure. We will say what was tested, what was found, and what was verified after remediation.

We will not claim accreditation we do not hold. Reviewer independence is described accurately when an independent reviewer is engaged.

We will not include findings without reproducible evidence.