Pentest-Tools.com API Scanner
Pentest-Tools.com API Scanner is a cloud tool for assessing APIs and detecting vulnerabilities such as SQL injection, SSRF, local file inclusion, code inject…
What Pentest-Tools.com API Scanner is
Pentest-Tools.com API Scanner is a cloud tool for assessing APIs and detecting vulnerabilities such as SQL injection, SSRF, local file inclusion, code injection, and request URL override. It supports REST and GraphQL APIs, plus Postman Collections, and accepts OpenAPI 2 and 3 specifications in YAML, YML, or JSON. Authenticated scans can use request headers, including Basic Authorization and JWT tokens. Reports include risk summaries, vulnerability evidence, remediation advice, and a list of more than 40 tests. Depending on the plan, exports can be PDF, HTML, CSV, XLSX, or editable DOCX. Integrations listed include Jira, Slack, Microsoft Teams, Discord, webhooks, Nucleus, Vanta, Burp Suite, AWS, Azure Marketplace, GitHub Actions, and a REST API. The seven-day trial requires a business email and card, and costs nothing if canceled before day eight.
Good
- Supports REST, GraphQL, and Postman Collections.
- Authenticated scans can use Basic Authorization or JWT.
- Reports include evidence and remediation advice.
- Lists more than 40 tests.
- Offers several report export formats, depending on plan.
Watch out
- Seven-day trial requires a business email and card.
- API scanning is limited in NetSec.
- Reports are deleted 30 days after generation.
- Pricing varies by asset count and billing cycle.
Who it suits
This scanner is aimed at penetration testers and other information security professionals, including offensive and defensive security teams. It may also suit system builders or administrators assessing APIs.
Verdict
The scanner covers common API formats and authenticated assessments, with evidence and remediation details in reports. Compare plan limits before choosing, especially if API scanning is central to the work.
Plans and prices
From Pentest-Tools.com API Scanner's own pricing page, checked 29 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| NetSec | $95 a month | Network scanning · cloud scanning · password auditing · reconnaissance · limited web and API scanning · From $95/month with 5 assets; price varies by asset count and billing cycle. |
| WebNetSec | $140 a month | Everything in NetSec · DAST · authenticated web scans · REST and GraphQL API scanning · CMS scanning · From $140/month with 5 assets; price varies by asset count and billing cycle. |
| Pentest Suite | $190 a month | Everything in WebNetSec · automated CVE exploitation · SQL injection and XSS exploiters · pentest report generator · From $190/month with 5 assets; price varies by asset count and billing cycle. |
The facts
Each one read from Pentest-Tools.com API Scanner's own pages, with the date it was checked.
What it does
- Authentication
- Authenticated scans can use request headers with methods including Basic Authorization and JWT tokens.checked 29 Sep 2026
- Data protection
- The company says customer data is encrypted at rest with AES-256 and in transit with TLS 1.2+, and reports are automatically deleted 30 days after generation.checked 29 Sep 2026
- Hosting and residency
- The product runs in Hetzner and Linode data centers in the EU, UK, Iceland, and US; new customers can choose US or Europe data hosting.checked 29 Sep 2026
- Integrations
- The platform lists Jira, Slack, Microsoft Teams, Discord, webhooks, Nucleus, Vanta, Burp Suite, AWS, Azure Marketplace, GitHub Actions, and a REST API among its integrations.checked 29 Sep 2026
- Intended users
- The company describes its tools as made for penetration testers and other information security professionals, and the API scanner page names offensive and defensive security teams and system builders or administrators as users.checked 29 Sep 2026
- Purpose
- The online API Vulnerability Scanner assesses APIs and detects vulnerabilities including SQL injection, SSRF, local file inclusion, code injection, and request URL override.checked 29 Sep 2026
- Reports
- Reports include risk summaries, vulnerability evidence, remediation advice, and a list of 40+ tests; exports vary by plan and include PDF, HTML, CSV, XLSX, or editable DOCX.checked 29 Sep 2026
- Security certification and privacy
- PentestTools SA says it is certified to ISO/IEC 27001:2023 and processes customer data under GDPR.checked 29 Sep 2026
- Specification support
- It supports OpenAPI versions 2 and 3 in YAML, YML, and JSON formats.checked 29 Sep 2026
- Supported APIs
- The scanner works on REST APIs, GraphQL APIs, and Postman Collections.checked 29 Sep 2026
The company
- Founded
- 2017checked 28 Sep 2026
- Headquarters
- Bucharest, Romania, Europechecked 28 Sep 2026
Money
- Plan limits
- Pricing states that API scanning is limited in NetSec and included in WebNetSec, while all plans include API access and unlimited scans on assets.checked 29 Sep 2026
- Trial terms
- The full scanner trial lasts 7 days, requires a business email and card, and costs nothing if canceled before day 8.checked 29 Sep 2026
Alternatives to Pentest-Tools.com API Scanner
- 1
AttackIQ Platform
Free planWebAPILinuxmacOS7.9From $4,995 a month - 2
Kali Linux
Free planOpen sourceAndroidLinuxmacOSSelf-hosted7.6Free plan - 3
OWASP ZAP
Free planOpen sourceAPIExtensionLinuxmacOS7.6Free plan - 4
ImmuniWeb
AndroidiOSWebAPI6.8From €595 a year - 5
Astra Security
WebAPI6.5From $699 a year - 6
Atomic Red Team
Free planAPILinuxmacOSWindows6.2Free plan