AquilaX API Security Scanner analyzes API specifications and probes running endpoints to identify security weaknesses. Its checks address the OWASP API Security Top 10, including broken authentication, object-level authorization problems, mass assignment, excessive data exposure, and rate-limiting gaps. Supported inputs include OpenAPI 3.x and Swagger 2.0, GraphQL schemas, gRPC/Protobuf, Postman collections, discovered URLs, REST APIs, and webhook endpoints. The API scanner is available on Premium and Ultimate plans, though all plans include unlimited scans without per-scan fees or scan quotas. AquilaX lists more than 50 integrations, including GitHub, GitLab, Jira, Slack, and Azure DevOps, as well as connections to CI/CD systems and IDEs such as GitHub Actions, Jenkins, VS Code, and JetBrains IDEs. It supports web, API, extension, and self-hosted deployments; on-premises options include air-gapped environments. AquilaX says source code is analyzed in isolated temporary environments, and that data in transit and stored findings are encrypted. Premium starts at $19/mo; Ultimate is 99.00 USD per developer per month and includes a 14-day free trial.
Who it is for
The scanner may suit development and security teams that need to check APIs against common API security risks. Its self-hosted and air-gapped deployment options may be relevant to teams with those deployment needs.
What is good
- Checks endpoints against the OWASP API Security Top 10.
- Accepts multiple API specifications and collection formats.
- All plans include unlimited scans.
- Lists more than 50 integrations.
- Supports self-hosted, on-premises, and air-gapped deployment.
What to know first
- API scanner requires Premium or Ultimate.
- Free plan does not list API security scanning.
Verdict
AquilaX combines specification analysis with runtime probing and supports a broad range of API inputs. The API scanner is not part of the listed Free plan, so check plan availability before choosing it.
AquilaX API Security Scanner plans and pricing
All plansCompared on API security testing software
- Free plan
- Yes
- Paid from
- $19/mo
- API discovery
- Yes
- Authentication testing
- Yes
- Authorization testing
- Yes
- Input-validation testing
- Yes
- Deployment
- hybrid
- API formats
- OpenAPI 3.x; Swagger 2.0; GraphQL Schema; gRPC/Protobuf; Postman Collections; REST APIs; Webhook endpoints
