AquilaX API Security Scanner
AquilaX API Security Scanner checks APIs by analyzing their specifications and probing running endpoints.
What AquilaX API Security Scanner is
AquilaX API Security Scanner checks APIs by analyzing their specifications and probing running endpoints. Its tests target the OWASP API Security Top 10, including broken authentication, object-level authorization issues, mass assignment, excessive data exposure, and rate-limiting gaps. It accepts OpenAPI 3.x and Swagger 2.0 specifications, GraphQL schemas, gRPC/Protobuf, Postman collections, discovered URLs, REST APIs, and webhook endpoints. The scanner is available on Premium and Ultimate plans; all plans include unlimited scans without scan quotas or per-scan fees. AquilaX lists more than 50 integrations, including GitHub, GitLab, Jira, Slack, and Azure DevOps, as well as CI/CD and IDE connections such as GitHub Actions, Jenkins, VS Code, and JetBrains IDEs. It can be used through web, API, extension, or self-hosted deployments. On-premises options support air-gapped environments. AquilaX says source code is processed in isolated temporary environments and that data in transit and stored findings are encrypted.
Good
- Tests against the full OWASP API Security Top 10
- Accepts OpenAPI, GraphQL, gRPC, Postman, and other inputs
- All plans include unlimited scans
- Lists more than 50 integrations
- On-premises deployment supports air-gapped environments
Watch out
- API Security scanner requires Premium or Ultimate
- Free plan does not include the API scanner
Who it suits
It suits teams that need to assess API security across common specification formats and running endpoints. Teams seeking an on-premises or air-gapped deployment can consider its self-hosted options.
Verdict
AquilaX combines specification analysis with active API probing and supports several API formats. Its API scanner is a paid-plan feature, though unlimited scans are included across plans.
Plans and prices
From AquilaX API Security Scanner's own pricing page, checked 1 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Free | Free | Secrets scanning · PII detection · compliance auditing · unlimited scans · CI/CD + IDE integration · Forever · no credit card |
| Premium | $19 a month | Everything in Free · SAST · SCA · DAST · container security · IaC scanner · API security scanner · 7 scan engines total · per developer / month · billed to your org |
| Ultimate | $99 a month | Everything in Premium · malware detection · Vibe Code · Securitron AI · AI remediation · on-premises deployment · per developer / month · billed to your org · 14-day free trial |
| Enterprise & Custom Deployments | Priced on request | Custom seat counts · SSO/SAML · dedicated Securitron AI model · single-tenant on-premises · enterprise SLA · volume discounts · Pricing may vary |
The facts
Each one read from AquilaX API Security Scanner's own pages, with the date it was checked.
What it does
- API formats
- Supported inputs include OpenAPI 3.x, Swagger 2.0, GraphQL schemas, gRPC/Protobuf, Postman collections, discovered URLs, REST APIs, and webhook endpoints.checked 1 Oct 2026
- API scanner availability
- The API Security scanner is available on Premium and Ultimate plans.checked 1 Oct 2026
- API testing
- AquilaX combines OpenAPI/Swagger specification analysis with active runtime probing to detect BOLA, broken authentication, mass assignment, excessive data exposure, and rate-limiting gaps.checked 1 Oct 2026
- CI/CD and IDE
- The platform integrates with GitHub Actions, GitLab CI, Jenkins, Azure Pipelines, CircleCI, Bitbucket Pipelines, TeamCity, VS Code, and JetBrains IDEs.checked 1 Oct 2026
- Data handling
- AquilaX says source code is analyzed in ephemeral isolated environments, only security findings are retained, and scan containers are destroyed after analysis.checked 1 Oct 2026
- Deployment
- On-premises deployment supports Docker and Docker Compose, air-gapped environments, Ubuntu 22.04 LTS or RHEL 9, and full data sovereignty.checked 1 Oct 2026
- Encryption
- AquilaX states that data in transit uses TLS 1.3 and stored findings and metadata use AES-256 encryption.checked 1 Oct 2026
- Integrations
- AquilaX lists more than 50 integrations, including GitHub, GitLab, Jira, Slack, Azure DevOps, Bitbucket, and REST API access.checked 1 Oct 2026
- OWASP coverage
- The API scanner tests every endpoint against the full OWASP API Security Top 10 using static specification analysis and dynamic runtime testing.checked 1 Oct 2026
- Scan limits
- All plans include unlimited scans with no per-scan fees or scan quotas.checked 1 Oct 2026
- Security certifications
- The Trust Center lists ISO 27001, SOC 2, PCI-DSS, and GDPR among AquilaX’s certifications or compliance commitments.checked 1 Oct 2026
- Support
- Ultimate includes priority support, while on-premises deployments include full onboarding support and offer enterprise SLA options.checked 1 Oct 2026
The company
- Company positioning
- AquilaX describes itself as an AI-powered application-security platform for modern DevSecOps teams.checked 1 Oct 2026
- Founded
- 2022checked 28 Sep 2026
- Headquarters
- United Kingdomchecked 28 Sep 2026
Alternatives to AquilaX API Security Scanner
- 1
42Crunch API Security Platform
Free planWebAPIExtensionLinux7.9From $9 a month - 2
APISec Platform
Free planWebAPIExtensionLinux7.5From $690 a month - 3
WuppieFuzz
Free planOpen sourceAPILinuxmacOSSelf-hosted7.3Free plan - 4
Beagle Security
Free planWebAPI6.9From $99 a month - 5
StackHawk HawkScan
WebAPILinuxmacOS6.8From $10 a month - 6
Parasoft SOAtest
AndroidiOSAPILinux6.7