Solutions / APIs
API penetration testing for REST and GraphQL.
APIs carry most of the business logic and most of the data — and they are where access-control bugs hide. Cyrion agents enumerate your endpoints, learn how objects and roles relate, then probe for the authorization gaps that automated scanners rarely find.
Coverage
- Broken object-level and function-level authorization (BOLA / BFLA).
- Authentication flaws: token replay, weak signing keys, missing expiry, OAuth misconfiguration.
- Mass assignment and excessive data exposure in responses.
- GraphQL introspection, batching and query-depth abuse.
- Rate-limit and anti-automation bypasses on sensitive endpoints such as login and password reset.
How an API engagement runs
Agents start from your documentation, an OpenAPI or GraphQL schema, or traffic observed while crawling the front end. They build a model of resources and roles, generate hypotheses about where ownership checks are missing, and confirm each one with paired requests from different identities.
Reporting
- Each finding includes the request pair that proves the issue.
- Results are mapped to the OWASP API Security Top 10.
- Re-tests run automatically after you ship a fix.