Freedom251 › Offensive Security
Pentest-Tools.com API Scanner
What Pentest-Tools.com API Scanner is
Pentest-Tools.com API Scanner is a cloud tool for assessing APIs and identifying vulnerabilities such as SQL injection, SSRF, local file inclusion, code injection, and request URL override. It supports REST and GraphQL APIs as well as Postman Collections, and accepts OpenAPI 2 and 3 specifications in YAML, YML, or JSON. Authenticated scans can use request headers with methods such as Basic Authorization and JWT tokens. Reports include risk summaries, vulnerability evidence, remediation guidance, and a list of more than 40 tests. Depending on plan, report exports can include PDF, HTML, CSV, XLSX, or editable DOCX. Listed integrations include Jira, Slack, Microsoft Teams, Discord, webhooks, Nucleus, Vanta, Burp Suite, AWS, Azure Marketplace, GitHub Actions, and a REST API. A free plan is available. Paid plans start at $95 a month, with API scanning limited in NetSec and included in WebNetSec. The seven-day trial requires a business email and card, and costs nothing if canceled before day eight.
Who it suits
The scanner is aimed at penetration testers and other information security professionals, including offensive and defensive security teams, system builders, and administrators. It may suit teams assessing REST or GraphQL APIs and Postman Collections.
What it does well
- Supports REST, GraphQL, and Postman Collections
- Accepts OpenAPI 2 and 3 specifications
- Authenticated scans can use Basic Auth or JWT
- Reports include evidence and remediation guidance
- Lists integrations including Jira and GitHub Actions
What to know first
- NetSec has limited API scanning
- Seven-day trial requires a business email and card
- Trial costs nothing only if canceled before day eight
- Reports are automatically deleted after 30 days
Limits
API scanning is limited in NetSec and included in WebNetSec, which starts at $140 per month. The seven-day full scanner trial requires a business email and card; cancel before day 8 to pay nothing.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| WebNetSec | From $140/month with 5 assets; price varies by asset count and billing cycle. · Everything in NetSec · DAST · authenticated web scans · REST and GraphQL API scanning · CMS scanning | $140 a month |
| Pentest Suite | From $190/month with 5 assets; price varies by asset count and billing cycle. · Everything in WebNetSec · automated CVE exploitation · SQL injection and XSS exploiters · pentest report generator | $190 a month |
| NetSec | From $95/month with 5 assets; price varies by asset count and billing cycle. · Network scanning · cloud scanning · password auditing · reconnaissance · limited web and API scanning | $95 a month |
As pentest-tools.com lists them, read 29 Sept 2026. The maker's own page has the final word.
Getting started
- Open the API Scanner website.
- Choose the free plan or a paid plan; API scanning is included in WebNetSec.
- For the seven-day trial, provide a business email and card; cancel before day 8 to pay nothing.
- Provide a REST or GraphQL API, Postman Collection, or OpenAPI 2 or 3 specification.
- Add request headers for an authenticated scan if needed.
- Review the report and export it in a format available for your plan.
Verdict
The scanner covers common API formats and authenticated scans, with evidence and remediation guidance in reports. Check the plan-specific API scanning and export limits, and the trial cancellation condition, before choosing a plan.
Questions
Is there a free plan?
Yes. The product lists a free plan.
How much do paid plans cost?
NetSec is listed at $95 a month, with five assets; its price varies by asset count and billing cycle. WebNetSec is listed at $140 a month with five assets, and Pentest Suite at $190 a month with five assets.
What does the trial require?
The full scanner trial lasts seven days and requires a business email and card. It costs nothing if canceled before day 8.
Which API definitions can it scan?
It supports REST and GraphQL APIs, Postman Collections, and OpenAPI versions 2 and 3 in YAML, YML, or JSON.
What integrations are listed?
Integrations include Jira, Slack, Microsoft Teams, Discord, webhooks, Nucleus, Vanta, Burp Suite, AWS, Azure Marketplace, GitHub Actions, and a REST API.
Where is customer data hosted and protected?
The product runs in Hetzner and Linode data centers in the EU, UK, Iceland, and US; new customers can choose US or Europe hosting. PentestTools SA says data is encrypted at rest with AES-256 and in transit with TLS 1.2+, and reports are deleted 30 days after generation.
Facts from Pentest-Tools.com API Scanner's own pages
- Authentication
- Authenticated scans can use request headers with methods including Basic Authorization and JWT tokens. · pentest-tools.com, 29 Sept 2026
- Data protection
- The company says customer data is encrypted at rest with AES-256 and in transit with TLS 1.2+, and reports are automatically deleted 30 days after generation. · pentest-tools.com, 29 Sept 2026
- Founded
- 2017 · pentest-tools.com, 28 Sept 2026
- Headquarters
- Bucharest, Romania, Europe · pentest-tools.com, 28 Sept 2026
- Hosting and residency
- The product runs in Hetzner and Linode data centers in the EU, UK, Iceland, and US; new customers can choose US or Europe data hosting. · pentest-tools.com, 29 Sept 2026
- Integrations
- The platform lists Jira, Slack, Microsoft Teams, Discord, webhooks, Nucleus, Vanta, Burp Suite, AWS, Azure Marketplace, GitHub Actions, and a REST API among its integrations. · pentest-tools.com, 29 Sept 2026
- Intended users
- The company describes its tools as made for penetration testers and other information security professionals, and the API scanner page names offensive and defensive security teams and system builders or administrators as users. · pentest-tools.com, 29 Sept 2026
- Plan limits
- Pricing states that API scanning is limited in NetSec and included in WebNetSec, while all plans include API access and unlimited scans on assets. · pentest-tools.com, 29 Sept 2026
- Purpose
- The online API Vulnerability Scanner assesses APIs and detects vulnerabilities including SQL injection, SSRF, local file inclusion, code injection, and request URL override. · pentest-tools.com, 29 Sept 2026
- Reports
- Reports include risk summaries, vulnerability evidence, remediation advice, and a list of 40+ tests; exports vary by plan and include PDF, HTML, CSV, XLSX, or editable DOCX. · pentest-tools.com, 29 Sept 2026
- Security certification and privacy
- PentestTools SA says it is certified to ISO/IEC 27001:2023 and processes customer data under GDPR. · pentest-tools.com, 29 Sept 2026
- Specification support
- It supports OpenAPI versions 2 and 3 in YAML, YML, and JSON formats. · pentest-tools.com, 29 Sept 2026
- Supported APIs
- The scanner works on REST APIs, GraphQL APIs, and Postman Collections. · pentest-tools.com, 29 Sept 2026
- Trial terms
- The full scanner trial lasts 7 days, requires a business email and card, and costs nothing if canceled before day 8. · pentest-tools.com, 29 Sept 2026
Where Pentest-Tools.com API Scanner stands on Freedom251
- Offensive Security#7 of 22
- API Security Testing Software#10 of 27