Pentestas API Scanner

Input—per 1M tokens

Output—per 1M tokens

Context—tokens

WeightsClosed

About

Pentestas API Scanner is ranked #8 of 25 in API security testing software on Inferse. It runs on API, Web. A free trial is offered. Paid plans start at $6.58/mo.

Compared on API security testing software

Free plan: Yespentestas.com
Paid from: $99/mopentestas.com
API discovery: Yespentestas.com
Authentication testing: Yespentestas.com
Authorization testing: Yespentestas.com
Input-validation testing: Yespentestas.com
Deployment: hybridpentestas.com
API formats: REST, SOAP, OpenAPI, Swagger, Postman, GraphQL, gRPCpentestas.com

Facts

Purpose: API Scanner scans live APIs, analyzes Swagger/OpenAPI specifications, and decodes JWTs to inspect claims and signature weaknesses.pentestas.com · 2 Oct 2026
Protocols: The scanner covers REST and SOAP requests using GET, POST, PUT, PATCH, and DELETE with authentication variants and common injection payloads.pentestas.com · 2 Oct 2026
Automated checks: Its automated checks include authentication, authorization, mass assignment, injection, and JWT-signing checks.pentestas.com · 2 Oct 2026
OpenAPI analysis: The OpenAPI/Swagger parser flags endpoints without authentication, overly broad scopes, undocumented response codes, and missing rate limits.pentestas.com · 2 Oct 2026
JWT checks: JWT checks include alg=none, weak HS256 secrets, kid injection, missing exp/iss/aud, and signature stripping.pentestas.com · 2 Oct 2026
Authorization checks: The tool runs BOLA and BFLA probes for broken object-level and function-level authorization.pentestas.com · 2 Oct 2026
Results: Findings are grouped by endpoint or claim with severity and a one-line remediation; reports can be exported as PDF, CSV, or JSON.pentestas.com · 2 Oct 2026
Integrations: The page says results can be fed into SIEM, ticketing systems, or CI/CD pipelines through the REST API.pentestas.com · 2 Oct 2026
Security and privacy: Pentestas says scan data is encrypted at rest and in transit, and users control data retention and export.pentestas.com · 2 Oct 2026
Free usage limit: The free tier allows two runs per tool per IP per day, and the page says it does not keep history.pentestas.com · 2 Oct 2026
GraphQL limit: GraphQL is not covered on this page; Pentestas directs users to its separate GraphQL Scanner.pentestas.com · 2 Oct 2026
Support: The pricing page lists email support for Starter, priority chat for Professional, and phone support with SLA guarantees for Business.pentestas.com · 2 Oct 2026