What your APIs say about themselves to anyone outside, before a client or a stranger finds out
Whoever integrates with your APIs never sees your code: they see responses. CODEPRESS's API audit takes that seat, outside the boundary, and in two weeks for a fixed €1,500-€3,000 delivers an inventory of what the interface reveals or breaks: an inconsistent contract, authentication that can be walked around, surplus fields, slowness under real traffic, documentation gone stale. Beside each entry, the fix and the days it asks for.
€1,500 – €3,0002 weeks · fixed price
What an API audit is for
An API that works for your own frontend is not the same thing as an API ready for someone else to use. Whoever integrates with it finds a contract that shifts from one endpoint to the next, fields that disappear without warning, old versions still reachable because nobody ever really switched them off. Whoever consumes it notices before whoever wrote it does, and almost always in production.
The same boundary that makes integration possible is the one an outsider tries to force: a token that never expires, an endpoint that returns more fields than the caller should see, a rate limit that doesn't exist. The audit reads the API with both views at once, the one of whoever has to build on top of it and the one of whoever is looking for a way in, and writes down what it finds.
What an API audit covers
Contract and versioning
We compare the declared schema against the real responses, endpoint by endpoint, and check that a new version doesn't break clients still relying on the old one.
Authentication and data exposure
We check how callers authenticate, what they can see once inside, and whether any response returns fields the caller should never receive.
Performance under real traffic
Pagination, cascading queries, timeouts that are too generous or missing altogether: we measure what happens when traffic isn't the clean case from the test suite.
Documentation
We compare what the documentation promises against what the API actually does, and flag every point where the two have drifted apart.
How an API audit works
Access and context
All we need is access to the API in a test or staging environment, its documentation if it exists, and half an hour to understand who calls it and why.
Analysis
We call every endpoint with valid and invalid data, compare the responses against the declared contract, and try the combinations an honest client never would.
Verifying the findings
Every anomaly we find gets reproduced before it goes in the report: a finding that can't be reproduced doesn't help your team decide what to do.
Handing the findings back
The report arrives written, then we walk it endpoint by endpoint on a call with the people who maintain the APIs and the people who integrate with them: by the end the list of findings has become a list of decisions.
What you get from an API audit
- Every finding with its endpoint, its method and the exact call that surfaces it, in order of severity
- The map of the real contract compared against the one declared or documented
- For each finding, the correction we recommend and how many days it asks of whoever applies it
- The points where authentication or authorisation expose more than they should
- Performance measured under realistic traffic, not only under the ideal case
- A one-hour call where we walk your team through the findings
When an API audit is not for you
- The APIs are still on the whiteboard: until a real call answers there is nothing to read from outside, and a PoC or feature development is the better place to start.
- You need a signed penetration test certificate to hand a client or an auditor: we read the boundary, we do not break through it, and the document never pretends otherwise.
- There is no real traffic on the API yet: any performance finding would be a prediction, not a measurement, and the audit doesn't pass it off as one.
What an API audit costs, and why
Inside the €1,500-€3,000 band, surface decides: how many endpoints are reachable, how many separate services take part in forming the contract, whether documentation already exists to work from. Every extra endpoint is more calls to make, compare and reproduce, and that alone is what moves the number.
The figure is set after a first pass over the APIs and stays there through delivery. If endpoints nobody had counted turn up, we stop and talk about it before going on: you do not find out on the invoice.
API audit: frequently asked questions
- How much does an API audit cost?
- €1,500-€3,000, set before we begin and not touched afterwards. Where you land inside that band depends on the exposed surface: how many endpoints are reachable and how many separate services take part in the contract. If the scope grows while we work, we say so at once and decide together, but the agreed figure never moves on its own.
- What is the difference between an API audit and a penetration test?
- We look at the API from the same side a client integrating with it would, or an outsider trying to break in: from the outside boundary, without touching the source code. That puts us nearer to a penetration test in vantage point, but the method stays different: we read the contract, the authentication and the responses, we don't attempt to exploit a flaw or build an attack chain. If you need that too, it's a separate engagement.
- Do the APIs need to be documented first?
- No. It helps, because we compare what the documentation promises against what the API actually does, and every mismatch becomes a finding. But the audit works without it too: in that case we reconstruct the contract by observing the real responses, endpoint by endpoint, before the review starts.
- Do you look at performance or only security?
- Both. We look at pagination, cascading queries and timeouts under real traffic alongside authentication and data exposure: they are two sides of the same coin, and separating them would only make sense on an API you already know inside out, not one you are about to expose to outsiders for the first time.
- What happens if you find a serious vulnerability?
- We flag it immediately, not when the final report is delivered: a flaw that exposes data or lets someone bypass authentication doesn't wait two weeks. We would rather send an unscheduled email the same day than a late finding, so your team can act before the audit is even finished.