$ pentest --target=api

API pen test. Different scope, different scope-control, different cost shape to web-app.

$ answer --question="What does an API pen test cost?"

An API pen test runs $4,000 to $20,000 from a mid-market vendor, driven by endpoint count and authentication complexity. REST APIs are usually cheapest per endpoint; GraphQL and gRPC carry a premium because of tooling and introspection effort. Astra's Pentest Plus tier at $5,999/yr includes API testing in scope on the published price card.

Last verified June 2026

$ stat --slot=1

$4-20K

Project quote band

Endpoint count drives band

$ stat --slot=2

$5,999/yr

Astra Pentest Plus

Web + API in scope

$ stat --slot=3

1-2 wk

Test duration

Typical mid-market

$ stat --slot=4

OWASP API

Coverage framework

API Security Top 10

$ drivers --price

Endpoint count
Number of routes and methods. The single biggest driver.
Authentication complexity
Bearer token, OAuth, mTLS, multi-tenant. Multi-tenant auth multiplies testing effort.
Protocol
REST cheapest, GraphQL adds introspection and query-complexity testing, gRPC adds protobuf reflection work.
Spec quality
A clean OpenAPI / GraphQL schema cuts scoping time. Undocumented APIs cost more to test.
Rate-limit boundaries
Testing rate-limit bypass adds engagement time.