API penetration testing cost in Hyderabad
What testing an API costs, which properties of an API push the price up, and where BERRY9's starting price sits next to published vendor figures. We test remotely from Hyderabad, for teams anywhere in India.
- API test
- From INR 27,000 + GST
- Covers
- REST, GraphQL and gRPC
- Typical duration
- 5 to 10 working days
- Market figures read
- 30 October 2026
Last reviewed
01 / BERRY9 price
What BERRY9 charges for an API test
An API with sign-in and roles is priced at the standard starting figure rather than the starter scope.
Starter scope
Starts fromINR 9,000 + 18% GST
The starter scope is priced from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest.
It is meant for small, well-defined targets, so it does not cover the test on this page.
- A vulnerability scan
- Manual checks
- A written report
API security testing
Starts fromINR 27,000 + 18% GST
Every other test starts from INR 27,000 + 18% GST.
A starting price: your API's figure is fixed in a written proposal once we know its endpoints, roles and environments.
- Requests built by hand against every role
- A reproduction for each finding
- A CVSS 3.1 score on every finding
Reading that retest line again: the free retest is part of the starter scope only. An API is priced beyond that scope, so ask the proposal what retest it includes.
02 / Price drivers
What moves the price of an API test
An API test is a count of things to try, and the count drives the price. Five properties of an API change that count most.
How many routes
Every route and method might lack a permission check, which makes the route count the first number we ask for. A GraphQL API is measured by the types, queries and mutations in its schema, since they all share one address.
Who can call it
Customers, support agents, administrators and partner keys each carry different rights. Add a second tenant and we can try swapping identifiers between tenants, which is where many serious flaws hide.
Which protocol
REST, GraphQL and gRPC call for different checks, so a product that offers more than one is tested for each.
Where it runs
One staging environment is the cheapest case. A production window or regional copies each add preparation and testing time.
How well it is documented
A specification (an OpenAPI file or GraphQL schema) spares us the time of mapping the surface by hand. Without one, that mapping is part of the job.
03 / Kinds of API
Five kinds of API and what each needs
The kind of API tells you what to expect from scoping.
Show details for Five kinds of API and what each needs
| Kind of API | What slows the test | Send us this first |
|---|---|---|
| The back end of a mobile app | Many routes used only by the app, a few roles, token handling | A route list or schema, and a test account for each role |
| A public developer API | Keys with scopes, rate limits, versioned routes, many kinds of caller | The specification, the key tiers and the addresses to test |
| A GraphQL API | A deep schema, authorization inside resolvers, abuse of expensive queries | The schema, plus accounts for each role |
| A partner or business-to-business API | Data kept apart per partner, callbacks, shared secrets | Two partner accounts, so data can be swapped between them |
| Internal services behind a gateway | How each service proves who it is and what one service accepts from another | A diagram of the services and access to the internal network |
All five share one starting price, from INR 27,000 + 18% GST. Once the counts are known, the proposal shows where yours falls.
04 / Market figures
What other vendors publish for an API test
Show details for What other vendors publish for an API test
The Indian price guides we read give figures for applications and for scans, not for APIs on their own. These are the API figures published by vendors that do break them out, read on 30 October 2026. They are marketing numbers and not audited averages.
- Ostorlab's September 2026 figure is US$3,000 to US$18,000 for one web app or API tested by hand.
- Three vendors (Blaze InfoSec, Stingrai and Invicti) point to US$4,000 to US$20,000 for API tests, in 2026.
- Invadel: an API from US$4,000, listed on its site with no date.
Dollar amounts do not convert neatly into Indian prices, since rates, scopes and taxes differ. They still show how others value the work.
The VAPT cost guide for India collects every figure we found, each named with its source.
05 / Reading a proposal
What an API proposal should state
Show details for What an API proposal should state
A headline figure tells you little until you see what it covers. Look for these six items in any API proposal, ours included.
- The count behind the figure. Routes, or schema types for GraphQL. If none is stated, nobody has agreed what happens when the real number is bigger.
- Roles and tenants. Every role and every tenant pairing in scope, because permission flaws sit in the gaps between them.
- Environments. Staging, production or both, with the windows for anything that touches production.
- Method. Requests built by hand, or a scanner pointed at a specification. They take very different time and catch different things.
- Deliverable. A reproduction and a fix for every finding, plus a summary a manager can read, as against a tool export.
- Retest. Whether one is included, how soon after the report it may be used and what it costs.
Our guide to choosing a VAPT company adds questions about testers and data handling.
06 / Outside the price
What the starting price does not cover
Show details for What the starting price does not cover
Three things are not inside the starting figure, and the proposal names each of them so nothing arrives as a surprise.
- GST, which is added at 18% to every amount in this guide.
- APIs run by other companies, such as a payment gateway or a messaging provider. They belong to those companies, so they are tested only with written permission from the owner.
- Heavy load testing against production. Volume and abuse checks run in agreed hours, and usually against staging, so they never touch live customers.
If your API grows or a new version ships mid-project, tell us early. A change in routes, roles or environments changes the scope, and the proposal states what it does to the price.
07 / Get a price
What to send for an accurate price
Show details for What to send for an accurate price
Four items let us price an API test accurately, and none of them takes much paperwork.
- The surface. An OpenAPI file, a GraphQL schema or a Postman collection, or a rough count of routes if you have none.
- The roles. An account for each, and two users in two tenants if the API serves several customers.
- The environments. The addresses to test, and whether staging holds realistic data. We prefer staging, because heavy abuse tests can run there without touching live customers.
- The limits. Third-party services we must leave alone and any hours when testing may not run.
We test APIs remotely, from our office in Hyderabad. If you are in the city, see also our VAPT services in Hyderabad; the API security testing page describes each test's coverage.
08 / Inquiry
Ask for a proposal
Tell us what the API does, how many routes and roles it has, which protocol it uses and when you need the report. To talk it through first, call +91 86868 92922 or email contact@berry9.com.
09 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
How much does API penetration testing cost in Hyderabad?
An API test starts from INR 27,000 + 18% GST. We work remotely from Hyderabad, so the price is the same wherever your team sits. Bigger APIs cost more, and the proposal that follows scoping fixes the price for yours. See the section on What BERRY9 charges for an API test above.
Do you price by the number of endpoints?
Not by a flat rate. The route count is the first number we ask for, but roles, tenants, protocol and environments all change the time needed, so the price follows the whole scope. See the section on What moves the price of an API test above.
Does GraphQL cost more than REST?
Sometimes. GraphQL adds permission checks inside resolvers, introspection, batching tricks and abuse of expensive queries. The proposal states what is covered for the API you actually have.
Is a retest part of the price?
The free retest sits inside the small starter scope. An API is priced beyond it, so the proposal tells you what retest you get before you agree.
Is it cheaper to test staging than production?
Staging is our preferred target, mostly because heavy tests can run there without reaching live customers. When production must be tested, we agree the hours and stop conditions in writing first.
Do we need an OpenAPI file before asking for a price?
No. A schema saves time, but if you have none we map the routes ourselves, which takes longer and hands you a list of your own routes as a bonus.
How long does an API test take?
Expect 5 to 10 working days for most API tests, counted from the first day of testing. A large API, many roles or several environments mean longer, with the dates listed in the proposal.
Is GST included in these prices?
All amounts here exclude GST, which is charged at 18% on top.