apPosture API Security
apPosture API Security inventories API endpoints and helps teams prioritize security risks.
What apPosture API Security is
apPosture API Security inventories API endpoints and helps teams prioritize security risks. It combines whether an endpoint is public, handles sensitive data, and lacks provable authentication into a prioritized “Risky” verdict. Endpoint labels distinguish those linked to both code and runtime, source code alone, or runtime observations alone. Discovery uses SAST attack-maps, DAST crawling, an attached OpenAPI specification, and external subdomain probing. Listed coverage includes OpenAPI, GraphQL, gRPC, HTTP/2, h2c, and REST. Teams can compare an OpenAPI specification with running endpoints to identify documented, shadow, declared-untested, and auth-drift states. Runtime correlation uses existing access logs out of band. The product offers API-scoped compliance across seven frameworks and SARIF export. Integrations include development, issue-management, collaboration, cloud, and container tools. Deployment options include self-hosting, the customer’s cloud, or a dedicated managed instance; self-hosting uses a local LLM and needs no outbound connection after setup. Pricing lists no free tier, a 30-day proof of concept, and API Security within Platform and Enterprise or as an add-on.
Good
- Prioritizes risks using exposure, sensitivity, and authentication.
- Compares OpenAPI specifications with running endpoints.
- Supports OpenAPI, GraphQL, gRPC, HTTP/2, h2c, and REST.
- Offers API-scoped compliance across seven frameworks.
- Can run self-hosted without outbound connections after setup.
Watch out
- No free tier is listed.
- Runtime protection is not included.
- Essentials lists a $2,000/year minimum.
- Included scan targets are listed as 0 targets.
Who it suits
It suits teams that need to map API endpoints, assess their risk, and compare specifications with running APIs. Self-hosting and cloud deployment options may suit organizations with specific deployment requirements.
Verdict
apPosture API Security combines endpoint discovery, risk prioritization, and contract comparison. Pricing has no free tier, and plan minimums and add-on details are worth checking against your deployment needs.
Plans and prices
From apPosture API Security's own pricing page, checked 15 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| API Security add-on | $15 a month | OWASP API Top 10 · schema drift · runtime inventory; included on Platform+ · per developer/month |
| Essentials | $35 a month | SAST · SCA · Secrets · IaC · Container · AI fix PRs · Monitor CI/CD gate · DAST add-on per URL · community support · billed annually; minimum $2,000/year |
| Platform | $70 a month | Everything in Essentials · 5 DAST target URLs · API security · cloud posture · ASPM attack-chain correlation · Block gate and PR decoration · SSO OIDC/SAML and SCIM · 8×5 priority support · billed annually; minimum $4,000/year |
| Enterprise | $90 a month | Everything in Platform · 10 target URLs with Agentic Pentest · STRIDE threat modeling · RBAC and multi-tenant · fail-closed gate · Evidence Vault · auditor portals · air-gapped included · 24×7 SLA and CSM · billed annually; minimum $7,500/year |
| Agentic Pentest uplift | $600 a year | Hypothesis generation and agentic exploitation on an existing dynamic-testing target · per DAST target URL/year |
| One-off engagement | $900, paid once | Dynamic testing plus Agentic Pentest and full report · one target; no subscription |
| DAST target URL | $900 a year | Crawl · active scan · deterministic proof; 5 URLs included on Platform and 10 on Enterprise · per registered target URL/year |
The facts
Each one read from apPosture API Security's own pages, with the date it was checked.
Where it runs
- Air-gapped operation
- The platform is designed to run offline with a local model, no required telemetry and no required outbound connection.checked 15 Oct 2026
- Compliance mapping
- Findings are mapped to OWASP Top 10, PCI-DSS v4, ISO 27001, SOC 2, NIST 800-53, HIPAA and GDPR.checked 15 Oct 2026
What it does
- API authentication
- Programmatic access uses scoped, revocable bearer tokens with the apt_ prefix; browser sessions use JWTs and MFA.checked 15 Oct 2026
- API CI controls
- API findings can enforce a CI score gate, export SARIF and map to seven compliance frameworks.checked 15 Oct 2026
- API discovery sources
- Endpoint discovery uses SAST attack maps, DAST crawls, attached OpenAPI specifications and external subdomain probing.checked 15 Oct 2026
- API inventory
- API Security inventories endpoints and assigns each a single A-F risk grade.checked 15 Oct 2026
- CI/CD integrations
- CI/CD gating supports GitHub, GitLab, Jenkins, Azure DevOps and Bitbucket, with Monitor-to-Block operation.checked 15 Oct 2026
- Code and runtime
- Endpoints are labeled Code + Runtime, From source, or Runtime-only to show code-to-runtime provenance.checked 7 Oct 2026
- Code-to-runtime
- Endpoints are labelled as Code plus Runtime, source-only or runtime-only to expose shadow APIs.checked 15 Oct 2026
- Compliance
- API Security offers API-scoped compliance across seven frameworks and supports SARIF export.checked 7 Oct 2026
- Contract comparison
- Users can attach an OpenAPI specification and compare declared endpoints with running traffic for documented, shadow, declared-untested and auth-drift states.checked 15 Oct 2026
- Contract diff
- An attached OpenAPI specification can be diffed against running endpoints to surface documented, shadow, declared-untested, and auth-drift states.checked 7 Oct 2026
- Data handling
- In self-hosted and customer-cloud deployments, apPosture says it never receives source code, scan data or findings.checked 15 Oct 2026
- Deployment
- Deployments run self-hosted through Docker Compose, in the customer’s cloud account or as a dedicated managed instance.checked 15 Oct 2026
- Deployment and privacy
- The platform can run self-hosted, in the customer's cloud, or as a dedicated managed instance; self-hosted deployment uses a local LLM and does not require outbound connections after setup.checked 7 Oct 2026
- Discovery
- Endpoint discovery draws on SAST attack-maps, DAST crawling, an attached OpenAPI specification, and external subdomain probing.checked 7 Oct 2026
- Documentation depth
- The documentation includes quick start, installation, platform architecture, API Security, CI/CD, governance, reporting, administration and troubleshooting sections.checked 15 Oct 2026
- Integrations
- Supported source-control connections include GitHub, GitHub Enterprise, GitLab, GitLab self-managed, Bitbucket and Azure DevOps.checked 15 Oct 2026
- License model
- The terms state that apPosture is licensed rather than sold and is authorized for defensive security testing.checked 15 Oct 2026
- Limit: regional pricing
- Published prices are for the local market; separate EU and GCC lists apply and are invoiced in local currency.checked 15 Oct 2026
- Limit: URL metering
- DAST and Agentic Pentest are metered by registered target URL, and the vendor does not offer an unlimited target allowance.checked 15 Oct 2026
The company
- Headquarters
- Baku, Azerbaijanchecked 28 Sep 2026
- LinkedIn company size
- LinkedIn lists the company size as 2–10 employees.checked 15 Oct 2026
Money
- Limit: no free tier
- The pricing page states there is no free tier; every option starts with a 30-day proof of concept.checked 15 Oct 2026
Alternatives to apPosture API Security
- 1
42Crunch API Security Platform
Free planWebAPIExtensionLinux7.9From $9 a month - 2
APIPosture
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.8From $9 a month - 3
Onam Security API Security
Free planWebAPILinuxmacOS7.8From $22 a month - 4
APISec Platform
Free planWebAPIExtensionLinux7.5From $690 a month - 5
DataDome API Protection
AndroidiOSWebAPI6.8From $3,830 a month - 6
Haltdos
Free planWebAPILinuxSelf-hosted6.8From $30 a month