Freedom251 › API Security Software
apPosture API Security
What apPosture API Security is
apPosture API Security inventories API endpoints and helps teams assess and prioritize their security risks. It combines whether an endpoint is public, handles sensitive data, and lacks provable authentication into a prioritized “Risky” verdict. Endpoint labels indicate whether findings connect both code and runtime observations, source code alone, or runtime observations alone. Discovery draws on SAST attack-maps, DAST crawling, an attached OpenAPI specification, and external subdomain probing. Listed protocol coverage includes OpenAPI import, GraphQL, gRPC, HTTP/2, h2c, and REST.
Teams can compare an attached OpenAPI specification with running endpoints to identify documented, shadow, declared-untested, and auth-drift states. Runtime correlation uses existing access logs out of band, rather than processing traffic inline. The product provides API-scoped compliance across seven frameworks and supports SARIF export. Listed integrations include GitHub, GitLab, Jenkins, Azure DevOps, Bitbucket, Jira, ServiceNow, Slack, Teams, Kubernetes, AWS, Azure, GCP, and KEV / EPSS.
Deployment choices include self-hosting, the customer's cloud, or a dedicated managed instance. Self-hosted use relies on a local LLM and does not require outbound connections after setup. Pricing starts at $35/mo billed annually, with a 30-day proof of concept for each edition. API Security is included with Platform and Enterprise, or available as an add-on.
Who it suits
This suits teams that need to inventory APIs, connect endpoint findings to source or runtime evidence, and compare running endpoints with OpenAPI contracts. It is also relevant to organizations seeking self-hosted deployment, API-scoped compliance, and integrations with development, cloud, or collaboration tools.
What it does well
- Prioritizes risk using endpoint exposure, sensitive data, and authentication evidence.
- Discovers endpoints through SAST, DAST, OpenAPI, and subdomain probing.
- Compares OpenAPI specifications with running endpoints for contract drift states.
- Supports GraphQL, gRPC, HTTP/2, h2c, and REST.
- Offers self-hosted, customer-cloud, and dedicated managed deployment.
- Provides API-scoped compliance across seven frameworks and SARIF export.
What to know first
- There is no free plan.
- Essentials has a $2,000/year minimum.
- Essentials lists API Security as a $15/dev/mo add-on.
- The listed included scan target count is 0 targets.
Limits
The proof of concept lasts 30 days. Essentials has a $2,000/year minimum and lists API Security at +$15/dev/mo; Platform and Enterprise include API Security, with minimums of $4,000/year and $7,500/year respectively. The listed included scan target count is 0 targets.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| API Security add-on | per developer/month · OWASP API Top 10 · schema drift · runtime inventory; included on Platform+ | $15 a month |
| Essentials | billed annually; minimum $2,000/year · SAST · SCA · Secrets · IaC · Container · AI fix PRs · Monitor CI/CD gate · DAST add-on per URL · community support | $35 a month |
| Agentic Pentest uplift | per DAST target URL/year · Hypothesis generation and agentic exploitation on an existing dynamic-testing target | $600 a year |
| Platform | billed annually; minimum $4,000/year · Everything in Essentials · 5 DAST target URLs · API security · cloud posture · ASPM attack-chain correlation · Block gate and PR decoration · SSO OIDC/SAML and SCIM · 8×5 priority support | $70 a month |
| Enterprise | billed annually; minimum $7,500/year · Everything in Platform · 10 target URLs with Agentic Pentest · STRIDE threat modeling · RBAC and multi-tenant · fail-closed gate · Evidence Vault · auditor portals · air-gapped included · 24×7 SLA and CSM | $90 a month |
| One-off engagement | one target; no subscription · Dynamic testing plus Agentic Pentest and full report | $900, paid once |
| DAST target URL | per registered target URL/year · Crawl · active scan · deterministic proof; 5 URLs included on Platform and 10 on Enterprise | $900 a year |
As apposture.com lists them, read 15 Oct 2026. The maker's own page has the final word.
Getting started
- Open https://apposture.com/products/api-security/.
- Choose an edition; each starts with the same 30-day proof of concept.
- Select self-hosted, customer-cloud, or dedicated managed deployment.
- For self-hosting, use the local LLM deployment, which needs no outbound connections after setup.
- Connect relevant listed integrations such as GitHub, Jira, Kubernetes, AWS, Azure, or GCP.
Verdict
Choose apPosture API Security if you need endpoint discovery, risk prioritization, and contract comparison, especially with self-hosting or customer-cloud deployment. The listed pricing has annual minimums, and Essentials requires an additional API Security fee; teams seeking a free plan should look elsewhere.
Questions
Is there a free plan?
No. Each edition starts with the same 30-day proof of concept.
How much does it cost?
Pricing starts at $35/mo billed annually. Essentials lists $35/dev/mo billed annually with a $2,000/year minimum; Platform is $70/dev/mo with a $4,000/year minimum; Enterprise is $90/dev/mo with a $7,500/year minimum.
Which plans include API Security?
Platform and Enterprise include API Security. Essentials lists it as a $15/dev/mo add-on.
Can it be self-hosted?
Yes. Deployment options include self-hosted, in the customer's cloud, or as a dedicated managed instance. Self-hosted deployment uses a local LLM and does not require outbound connections after setup.
Which protocols are covered?
Listed coverage includes OpenAPI import, GraphQL, gRPC, HTTP/2, h2c, and REST.
Which integrations are listed?
They include GitHub, GitLab, Jenkins, Azure DevOps, Bitbucket, Jira, ServiceNow, Slack, Teams, Kubernetes, AWS, Azure, GCP, SARIF, and KEV / EPSS.
Facts from apPosture API Security's own pages
- Air-gapped operation
- The platform is designed to run offline with a local model, no required telemetry and no required outbound connection. · apposture.com, 15 Oct 2026
- API authentication
- Programmatic access uses scoped, revocable bearer tokens with the apt_ prefix; browser sessions use JWTs and MFA. · docs.aspm.apposture.com, 15 Oct 2026
- API CI controls
- API findings can enforce a CI score gate, export SARIF and map to seven compliance frameworks. · apposture.com, 15 Oct 2026
- API discovery sources
- Endpoint discovery uses SAST attack maps, DAST crawls, attached OpenAPI specifications and external subdomain probing. · apposture.com, 15 Oct 2026
- API inventory
- API Security inventories endpoints and assigns each a single A-F risk grade. · apposture.com, 15 Oct 2026
- CI/CD integrations
- CI/CD gating supports GitHub, GitLab, Jenkins, Azure DevOps and Bitbucket, with Monitor-to-Block operation. · apposture.com, 15 Oct 2026
- Code and runtime
- Endpoints are labeled Code + Runtime, From source, or Runtime-only to show code-to-runtime provenance. · apposture.com, 7 Oct 2026
- Code-to-runtime
- Endpoints are labelled as Code plus Runtime, source-only or runtime-only to expose shadow APIs. · apposture.com, 15 Oct 2026
- Compliance
- API Security offers API-scoped compliance across seven frameworks and supports SARIF export. · apposture.com, 7 Oct 2026
- Compliance mapping
- Findings are mapped to OWASP Top 10, PCI-DSS v4, ISO 27001, SOC 2, NIST 800-53, HIPAA and GDPR. · apposture.com, 15 Oct 2026
- Contract comparison
- Users can attach an OpenAPI specification and compare declared endpoints with running traffic for documented, shadow, declared-untested and auth-drift states. · apposture.com, 15 Oct 2026
- Contract diff
- An attached OpenAPI specification can be diffed against running endpoints to surface documented, shadow, declared-untested, and auth-drift states. · apposture.com, 7 Oct 2026
- Data handling
- In self-hosted and customer-cloud deployments, apPosture says it never receives source code, scan data or findings. · apposture.com, 15 Oct 2026
- Deployment
- Deployments run self-hosted through Docker Compose, in the customer’s cloud account or as a dedicated managed instance. · apposture.com, 15 Oct 2026
- Deployment and privacy
- The platform can run self-hosted, in the customer's cloud, or as a dedicated managed instance; self-hosted deployment uses a local LLM and does not require outbound connections after setup. · apposture.com, 7 Oct 2026
- Discovery
- Endpoint discovery draws on SAST attack-maps, DAST crawling, an attached OpenAPI specification, and external subdomain probing. · apposture.com, 7 Oct 2026
- Documentation depth
- The documentation includes quick start, installation, platform architecture, API Security, CI/CD, governance, reporting, administration and troubleshooting sections. · docs.aspm.apposture.com, 15 Oct 2026
- Headquarters
- Baku, Azerbaijan · apposture.com, 28 Sept 2026
- Integrations
- Supported source-control connections include GitHub, GitHub Enterprise, GitLab, GitLab self-managed, Bitbucket and Azure DevOps. · apposture.com, 15 Oct 2026
- License model
- The terms state that apPosture is licensed rather than sold and is authorized for defensive security testing. · apposture.com, 15 Oct 2026
- Limit: no free tier
- The pricing page states there is no free tier; every option starts with a 30-day proof of concept. · apposture.com, 15 Oct 2026
- Limit: regional pricing
- Published prices are for the local market; separate EU and GCC lists apply and are invoiced in local currency. · apposture.com, 15 Oct 2026
- Limit: URL metering
- DAST and Agentic Pentest are metered by registered target URL, and the vendor does not offer an unlimited target allowance. · apposture.com, 15 Oct 2026
- LinkedIn company size
- LinkedIn lists the company size as 2–10 employees. · linkedin.com, 15 Oct 2026
Where apPosture API Security stands on Freedom251
- API Security Software#10 of 30