Pentest-Tools.com API Scanner

Input—per 1M tokens

Output—per 1M tokens

Context—tokens

WeightsClosed

About

Pentest-Tools.com API Scanner is ranked #2 of 29 in web application security scanners on Inferse. It runs on API, Linux, macOS, Web. A free trial is offered. Paid plans start at $95/mo.

Compared on web application security scanners

Free plan: Yespentest-tools.com
Paid from: $95/mopentest-tools.com
API discovery: Nopentest-tools.com
Authentication testing: Yespentest-tools.com
Input-validation testing: Yespentest-tools.com
Deployment: cloudpentest-tools.com
API formats: OpenAPI 2 and 3 in YAML, YML, or JSON; Postman Collectionpentest-tools.com

Facts

Purpose: The online API Vulnerability Scanner assesses APIs and detects vulnerabilities including SQL injection, SSRF, local file inclusion, code injection, and request URL override.pentest-tools.com · 29 Sept 2026
Supported APIs: The scanner works on REST APIs, GraphQL APIs, and Postman Collections.pentest-tools.com · 29 Sept 2026
Specification support: It supports OpenAPI versions 2 and 3 in YAML, YML, and JSON formats.pentest-tools.com · 29 Sept 2026
Authentication: Authenticated scans can use request headers with methods including Basic Authorization and JWT tokens.pentest-tools.com · 29 Sept 2026
Reports: Reports include risk summaries, vulnerability evidence, remediation advice, and a list of 40+ tests; exports vary by plan and include PDF, HTML, CSV, XLSX, or editable DOCX.pentest-tools.com · 29 Sept 2026
Trial terms: The full scanner trial lasts 7 days, requires a business email and card, and costs nothing if canceled before day 8.pentest-tools.com · 29 Sept 2026
Integrations: The platform lists Jira, Slack, Microsoft Teams, Discord, webhooks, Nucleus, Vanta, Burp Suite, AWS, Azure Marketplace, GitHub Actions, and a REST API among its integrations.pentest-tools.com · 29 Sept 2026
Security certification and privacy: PentestTools SA says it is certified to ISO/IEC 27001:2023 and processes customer data under GDPR.pentest-tools.com · 29 Sept 2026
Data protection: The company says customer data is encrypted at rest with AES-256 and in transit with TLS 1.2+, and reports are automatically deleted 30 days after generation.pentest-tools.com · 29 Sept 2026
Hosting and residency: The product runs in Hetzner and Linode data centers in the EU, UK, Iceland, and US; new customers can choose US or Europe data hosting.pentest-tools.com · 29 Sept 2026
Plan limits: Pricing states that API scanning is limited in NetSec and included in WebNetSec, while all plans include API access and unlimited scans on assets.pentest-tools.com · 29 Sept 2026