How to scope an API penetration test.

In this guide

Set the assessment objective

Are you preparing for a release, onboarding an enterprise customer, changing an identity provider or checking a new partner integration? Record the reason for the assessment and the decision-maker who will use the findings. A release-focused review and a broad assessment of an established platform may need different coverage.

Identify the important outcomes: which records must remain private, which actions need approval and which operations are restricted to particular users or services. Include known concerns and previous findings so the assessment can distinguish new work from retesting.

List APIs and connected systems

• Base URLs, environments and deployed API versions.
• Protocols and documentation: OpenAPI specifications, GraphQL schemas, gRPC definitions or a maintained equivalent, where available.
• Public, partner and internal interfaces that are included in the assessment.
• Identity providers, gateways, background jobs, callbacks and other relevant integrations.
• Web and mobile clients that rely on the API, with a clear statement of whether those clients are also in scope.

Document which systems your organisation owns and where a third party must approve testing. Do not assume that permission to test your application also covers its payment, identity or messaging provider.

Define roles and tenants

List the roles and the actions each role should be able to perform. For a multi-tenant product, explain how customer organisations are separated and whether there are legitimate cross-organisation workflows. Include administrative, support and machine-to-machine identities where they are relevant.

Provide representative test accounts and approved test records. If tenant isolation is a priority, arrange separate test tenants with known ownership of their records. Use a secure channel for credentials; the initial scoping email should contain only an account and role description.

Prioritise workflows

Endpoint count is an incomplete estimate of effort. Several endpoints may implement one simple action, while one operation may have complex approvals, permissions and state changes.

Identify the workflows that matter most to the business, such as customer onboarding, changes to access rights, payments, data export and partner administration. Explain the intended sequence and the conditions that must hold. Make a separate list of lower-priority or excluded functionality so time is allocated deliberately.

Set testing boundaries

Decide whether staging represents the production controls closely enough. Record differences in identity configuration, gateways, feature flags and integrations. If production is used, agree test windows, approved data, operational monitoring, emergency contacts and stop conditions.

Specify whether rate-limit review, source review or availability testing is included. Load testing and deliberately disruptive activity should not be inferred from the phrase “penetration test”. Agree how test records and temporary access will be removed when the work finishes.

Agree reporting and retesting

Ask for the tested scope, limitations, evidence, impact and recommended fixes, with a prioritised summary for decision-makers.

Agree the retest window, the fixes it will cover and how changed functionality will be treated. A new API version or a redesigned identity flow may require more work than checking the original findings.

Your scoping checklist

1. Objective: the release, assurance decision or security concern.
2. Scope: API families, versions, environments and connected systems.
3. Access: roles, tenants, test data and network arrangements.
4. Priorities: important workflows, known issues and exclusions.
5. Constraints: permissions, safety boundaries, deadlines and contact people.
6. Outputs: report audiences, remediation discussion and retest expectations.

A short description is enough to start the conversation. Share source code or sensitive architecture through an agreed secure channel. Use test credentials rather than production secrets.

Related services and reading

See our API penetration testing service for coverage and deliverables, or the application testing overview when the web, mobile or source-code scope needs to be assessed together. For a connected product, also read what to prepare for an IoT security assessment.