Pentestas API Scanner
Pentestas API Scanner examines live APIs, Swagger or OpenAPI specifications, and JWT claims for security weaknesses.
What Pentestas API Scanner is
Pentestas API Scanner examines live APIs, Swagger or OpenAPI specifications, and JWT claims for security weaknesses. It tests REST and SOAP requests using GET, POST, PUT, PATCH, and DELETE, with authentication variants and common injection payloads. Automated checks cover authentication, authorization, mass assignment, injection, and JWT signing. OpenAPI analysis identifies unauthenticated endpoints, broad scopes, undocumented response codes, and missing rate limits. JWT checks include alg=none, weak HS256 secrets, kid injection, missing exp, iss, or aud claims, and signature stripping. BOLA and BFLA probes test broken object-level and function-level authorization. Findings are grouped by endpoint or claim with severity and a remediation line, and reports export to PDF, CSV, or JSON. Results can feed SIEM, ticketing, or CI/CD systems through the REST API. The free tier allows two runs per tool per IP per day and keeps no history. Paid plans start at 99 /mo, with a 14-day trial.
Good
- Checks authentication and authorization weaknesses
- Covers REST and SOAP methods
- Inspects OpenAPI and Swagger definitions
- Exports PDF, CSV, and JSON reports
- Free tier available with trial
Watch out
- Free tier has two daily runs per tool per IP
- Free tier keeps no history
- GraphQL is handled by another scanner
- Paid plans start at 99 /mo
Who it suits
Pentestas API Scanner suits security teams and developers assessing REST or SOAP APIs, API specifications, and JWT implementations. It is useful when findings need export or delivery into operational security and development systems.
Verdict
Pentestas API Scanner combines specification review, live request testing, JWT checks, and authorization probes. The free limits and separate GraphQL product should be considered before choosing a plan.
Plans and prices
From Pentestas API Scanner's own pricing page, checked 2 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Starter | $948 a year | 5 scans per month · 1 verified domain · web vulnerability scanning · OWASP Top 10 · email support · Billed annually ($948/year); page also shows $99/month |
| Professional | $2,988 a year | Unlimited scans · 5 verified domains · API penetration testing · authenticated scanning · GitHub, GitLab, Jenkins · Slack and Jira · Billed annually ($2,988/year); page also shows $299/month |
| Business | $5,988 a year | Unlimited scans · 15 verified domains · AI exploitation engine · mobile app pentesting · phone support and SLA guarantees · Billed annually ($5,988/year); page also shows $599/month |
| Enterprise | Priced on request | Unlimited verified domains · custom integrations and on-premise · dedicated security team · Custom contract; flexible terms |
The facts
Each one read from Pentestas API Scanner's own pages, with the date it was checked.
What it does
- Authorization checks
- The tool runs BOLA and BFLA probes for broken object-level and function-level authorization.checked 2 Oct 2026
- Automated checks
- Its automated checks include authentication, authorization, mass assignment, injection, and JWT-signing checks.checked 2 Oct 2026
- GraphQL limit
- GraphQL is not covered on this page; Pentestas directs users to its separate GraphQL Scanner.checked 2 Oct 2026
- Integrations
- The page says results can be fed into SIEM, ticketing systems, or CI/CD pipelines through the REST API.checked 2 Oct 2026
- JWT checks
- JWT checks include alg=none, weak HS256 secrets, kid injection, missing exp/iss/aud, and signature stripping.checked 2 Oct 2026
- OpenAPI analysis
- The OpenAPI/Swagger parser flags endpoints without authentication, overly broad scopes, undocumented response codes, and missing rate limits.checked 2 Oct 2026
- Protocols
- The scanner covers REST and SOAP requests using GET, POST, PUT, PATCH, and DELETE with authentication variants and common injection payloads.checked 2 Oct 2026
- Purpose
- API Scanner scans live APIs, analyzes Swagger/OpenAPI specifications, and decodes JWTs to inspect claims and signature weaknesses.checked 2 Oct 2026
- Results
- Findings are grouped by endpoint or claim with severity and a one-line remediation; reports can be exported as PDF, CSV, or JSON.checked 2 Oct 2026
- Security and privacy
- Pentestas says scan data is encrypted at rest and in transit, and users control data retention and export.checked 2 Oct 2026
- Support
- The pricing page lists email support for Starter, priority chat for Professional, and phone support with SLA guarantees for Business.checked 2 Oct 2026
Money
- Free usage limit
- The free tier allows two runs per tool per IP per day, and the page says it does not keep history.checked 2 Oct 2026
Alternatives to Pentestas API Scanner
- 1
42Crunch API Security Platform
Free planWebAPIExtensionLinux7.9From $9 a month - 2
APISec Platform
Free planWebAPIExtensionLinux7.5From $690 a month - 3
WuppieFuzz
Free planOpen sourceAPILinuxmacOSSelf-hosted7.3Free plan - 4
Beagle Security
Free planWebAPI6.9From $99 a month - 5
StackHawk HawkScan
WebAPILinuxmacOS6.8From $10 a month - 6
AquilaX API Security Scanner
Free planWebAPIExtensionSelf-hosted6.7From $19 a month