Freedom251 › API Security Testing Software
Pentestas API Scanner
What Pentestas API Scanner is
Pentestas API Scanner examines live APIs, Swagger and OpenAPI specifications, and JWTs. It covers REST and SOAP requests made with GET, POST, PUT, PATCH, and DELETE, with authentication variants and common injection payloads. Automated checks address authentication, authorization, mass assignment, injection, and JWT signing. The OpenAPI parser can flag unauthenticated endpoints, overly broad scopes, undocumented response codes, and missing rate limits. JWT checks look for issues such as weak HS256 secrets, kid injection, missing exp, iss, or aud claims, and signature stripping. It also probes for broken object-level and function-level authorization. Findings are organized by endpoint or claim, with severity and a brief remediation; reports export as PDF, CSV, or JSON. Results can be sent to SIEM, ticketing, or CI/CD systems through the REST API. Pentestas says scan data is encrypted in transit and at rest, with user-controlled retention and export. The free tier allows two runs per tool per IP daily and keeps no history. GraphQL is not covered here; Pentestas directs users to a separate scanner.
Who it suits
It suits teams assessing REST or SOAP APIs and reviewing OpenAPI definitions or JWT handling. The free tier may suit limited use, while teams needing more scans or integrations can review the paid plans.
What it does well
- Checks authentication, authorization, injection, and mass assignment.
- Flags OpenAPI endpoint and rate-limit issues.
- Exports reports as PDF, CSV, or JSON.
- Offers a free plan and a 14-day trial.
What to know first
- Free tier allows two runs per tool per IP daily.
- Free tier does not keep history.
- GraphQL is handled by a separate scanner.
- Paid plans start at $99/mo.
Limits
The free tier allows two runs per tool per IP per day and does not retain history. Starter includes five scans per month and one verified domain; higher plans increase scan and domain allowances.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Professional | Billed annually ($2,988/year); page also shows $299/month · Unlimited scans · 5 verified domains · API penetration testing · authenticated scanning · GitHub, GitLab, Jenkins · Slack and Jira | $2,988 a year |
| Business | Billed annually ($5,988/year); page also shows $599/month · Unlimited scans · 15 verified domains · AI exploitation engine · mobile app pentesting · phone support and SLA guarantees | $5,988 a year |
| Starter | Billed annually ($948/year); page also shows $99/month · 5 scans per month · 1 verified domain · web vulnerability scanning · OWASP Top 10 · email support | $948 a year |
| Enterprise | Custom contract; flexible terms · Unlimited verified domains · custom integrations and on-premise · dedicated security team | On request |
As pentestas.com lists them, read 2 Oct 2026. The maker's own page has the final word.
Getting started
- Open the Pentestas API Scanner website
- Start with the free plan or begin the 14-day trial
- Choose a paid plan if you need higher scan or domain limits
- Provide a live API or Swagger/OpenAPI specification
- Run scans and review findings by endpoint or claim
- Export results or send them through the REST API
Verdict
Pentestas combines live API checks with specification and JWT analysis, and offers several report formats. Check the run limit and GraphQL coverage before choosing it; the page lists paid plans from $99/mo.
Questions
Is Pentestas API Scanner free?
A free plan is available, along with a 14-day trial. Paid access starts at $99/mo.
What does the Starter plan include?
Starter is listed at $79 a year billed annually ($948/year), with the page also showing $99/month. It includes five scans per month, one verified domain, web vulnerability scanning, OWASP Top 10 checks, and email support.
Does it test GraphQL APIs?
GraphQL is not covered on this scanner page. Pentestas directs users to its separate GraphQL Scanner.
Which paid integrations are listed?
Professional lists GitHub, GitLab, Jenkins, Slack, and Jira. Results can also feed SIEM, ticketing, or CI/CD systems through the REST API.
What support comes with the plans?
Starter lists email support, Professional lists priority chat, and Business lists phone support with SLA guarantees.
Facts from Pentestas API Scanner's own pages
- Authorization checks
- The tool runs BOLA and BFLA probes for broken object-level and function-level authorization. · pentestas.com, 2 Oct 2026
- Automated checks
- Its automated checks include authentication, authorization, mass assignment, injection, and JWT-signing checks. · pentestas.com, 2 Oct 2026
- Free usage limit
- The free tier allows two runs per tool per IP per day, and the page says it does not keep history. · pentestas.com, 2 Oct 2026
- GraphQL limit
- GraphQL is not covered on this page; Pentestas directs users to its separate GraphQL Scanner. · pentestas.com, 2 Oct 2026
- Integrations
- The page says results can be fed into SIEM, ticketing systems, or CI/CD pipelines through the REST API. · pentestas.com, 2 Oct 2026
- JWT checks
- JWT checks include alg=none, weak HS256 secrets, kid injection, missing exp/iss/aud, and signature stripping. · pentestas.com, 2 Oct 2026
- OpenAPI analysis
- The OpenAPI/Swagger parser flags endpoints without authentication, overly broad scopes, undocumented response codes, and missing rate limits. · pentestas.com, 2 Oct 2026
- Protocols
- The scanner covers REST and SOAP requests using GET, POST, PUT, PATCH, and DELETE with authentication variants and common injection payloads. · pentestas.com, 2 Oct 2026
- Purpose
- API Scanner scans live APIs, analyzes Swagger/OpenAPI specifications, and decodes JWTs to inspect claims and signature weaknesses. · pentestas.com, 2 Oct 2026
- Results
- Findings are grouped by endpoint or claim with severity and a one-line remediation; reports can be exported as PDF, CSV, or JSON. · pentestas.com, 2 Oct 2026
- Security and privacy
- Pentestas says scan data is encrypted at rest and in transit, and users control data retention and export. · pentestas.com, 2 Oct 2026
- Support
- The pricing page lists email support for Starter, priority chat for Professional, and phone support with SLA guarantees for Business. · pentestas.com, 2 Oct 2026
Where Pentestas API Scanner stands on Freedom251
- API Security Testing Software#16 of 27