API penetration testing
APIs hand out long-lived credentials and trust them on every subsequent call. Guardian measures what each key can reach, how far its permissions stretch, and what your systems do when one starts being used from somewhere new.
Offchain · API Pentest
What a stolen key is worth once someone else is holding it.
- Key scoping Permission granularity, whether read-only is genuinely read-only, IP allowlisting, expiry, and revocation that takes effect immediately.
- Endpoint authorization Per-object checks, tenant isolation, mass-assignment, and endpoints that trust a parameter the client controls.
- Abuse resistance Rate limiting, quota enforcement, replay protection, and whether limits are applied per key or trivially evaded.
- Surface discovery Undocumented, deprecated, and staging endpoints still reachable in production, plus schema drift between them.
- Authentication JWT signing and validation, OAuth flows, session and refresh tokens, 2FA and email steps, and the account-recovery paths that bypass all of them.
- Automation triggers Endpoints that fire relayers, bots, or onchain transactions, and multi-step flows that can be interrupted, replayed, or driven out of order.
Covers REST, GraphQL, gRPC, and custom protocols. Every endpoint is treated as its own piece of functionality and tested at each privilege level, so the review scales with what the API actually does rather than how large it is. Existing documentation, such as a Swagger file or Postman collection, and credentials for each role make that faster and more complete.
Exchange API keys were stolen and traded. The keys stayed valid, and the trades they placed were authorized. 3Commas · $22M (read the incident write-up)
Scoped by endpoint count and the roles behind them.
Audits & Pentests
Other engagements
Start now