Pentest-Tools.com API Scanner is a cloud tool for assessing APIs and identifying vulnerabilities such as SQL injection, SSRF, local file inclusion, code injection, and request URL override. It supports REST and GraphQL APIs as well as Postman Collections, and accepts OpenAPI 2 and 3 specifications in YAML, YML, or JSON. Authenticated scans can use request headers with methods such as Basic Authorization and JWT tokens. Reports include risk summaries, vulnerability evidence, remediation guidance, and a list of more than 40 tests. Depending on plan, report exports can include PDF, HTML, CSV, XLSX, or editable DOCX. Listed integrations include Jira, Slack, Microsoft Teams, Discord, webhooks, Nucleus, Vanta, Burp Suite, AWS, Azure Marketplace, GitHub Actions, and a REST API. A free plan is available. Paid plans start at 95.00 USD per month, with API scanning limited in NetSec and included in WebNetSec. The seven-day trial requires a business email and card, and costs nothing if canceled before day eight.
Who it is for
The scanner is aimed at penetration testers and other information security professionals, including offensive and defensive security teams, system builders, and administrators. It may suit teams assessing REST or GraphQL APIs and Postman Collections.
What is good
- Supports REST, GraphQL, and Postman Collections
- Accepts OpenAPI 2 and 3 specifications
- Authenticated scans can use Basic Auth or JWT
- Reports include evidence and remediation guidance
- Lists integrations including Jira and GitHub Actions
What to know first
- NetSec has limited API scanning
- Seven-day trial requires a business email and card
- Trial costs nothing only if canceled before day eight
- Reports are automatically deleted after 30 days
Verdict
The scanner covers common API formats and authenticated scans, with evidence and remediation guidance in reports. Check the plan-specific API scanning and export limits, and the trial cancellation condition, before choosing a plan.
Pentest-Tools.com API Scanner plans and pricing
All plansCompared on web application security scanners
- Free plan
- Yes
- Paid from
- $95/mo
- API discovery
- No
- Authentication testing
- Yes
- Input-validation testing
- Yes
- Deployment
- cloud
- API formats
- OpenAPI 2 and 3 in YAML, YML, or JSON; Postman Collection
