API security testing in Bangalore
For many Bengaluru companies the API is the product: customers integrate with it, mobile apps depend on it and, increasingly, AI assistants call it. BERRY9 tests those APIs remotely from Hyderabad, our only office, focusing on whether one customer's key can ever reach another customer's data.
- Typical duration
- 5 to 10 working days
- Testing
- Manual, by engineers
- Report
- Executive + engineering
- Delivery
- Remote from Hyderabad, on-site by arrangement
Last reviewed
01 / Local need
Why Bangalore product teams test their APIs
When the API is the product, a single authorization bug is a product bug.
Bengaluru software firms sell API access, power customers' own apps through it and let enterprise buyers build integrations on top. Their security reviews therefore concentrate on the API: how keys are scoped, how tenants are separated, how quickly abuse is limited and what the documentation reveals. Teams that have added an AI assistant or a tool server to their product have a newer question as well, because those endpoints call the same functions on behalf of a user.
Product teams in the city tend to freeze an API version for each customer integration, so the easiest window for a test is just before a new version is announced, when what customers will build against can still be tried and fixed without breaking anyone. The API security testing page describes the method; for how Bengaluru buyers compare firms, see VAPT services in Bangalore.
02 / Scope
What a Bangalore API test looks at first
The shape of a developer-facing product points to six places to start.
Tenant separation in the API
Every call carries a tenant. We test whether keys, tokens, identifiers or headers can be swapped to read or change another tenant's records, on every endpoint including exports.
API keys and scopes
Keys that never expire, keys that carry more rights than the customer chose, and keys shown in client-side code or mobile apps. We test creation, rotation and revocation.
Usage limits and abuse
Plans promise limits; the API has to enforce them. We test rate limits, quota resets, expensive queries and routes that send messages or create accounts.
AI assistants and tool endpoints
Assistants and tool servers act with a user's rights. We test who may call them, what they can reach and whether an instruction hidden in data can make them do more.
Documentation and sandboxes
Public docs and test environments often reveal more than intended: hidden routes, real data in sandboxes, verbose errors. We compare what is documented with what answers.
Webhooks to customers
Outgoing messages need signatures and replay protection, and the server should not fetch whatever address a customer supplies. We test both directions.
03 / From our guide
From our guide: authorization and limits
The two checks that decide most API reports for product companies are who may touch each object and what happens at volume. This is how our checklist treats them.
Check authorization on every object
Broken authorization is the leading API problem, and the OWASP API Security Top 10 from 2023 is still the current edition. Three of its entries cover it: object-level authorization, broken function-level authorization and broken object property-level authorization. Test them like this:
- Sign in as user A and note the identifiers in each request.
- Replay the request as user B, and with no login, and see whether the data comes back.
- Call administrator and internal functions with an ordinary user's token.
- Send extra fields in write requests, such as a role, a price or an owner, and check whether the server accepts them.
This must be done by hand with at least two accounts per role, because a scanner does not know which record belongs to whom.
Limits, volume and business flows
An API with correct permissions can still be abused at volume. Check rate limits on every route that sends a message, creates an account, applies a coupon or reveals data. The 2023 list names "unrestricted access to sensitive business flows" for this reason: the endpoint works as designed, and the harm comes from using it ten thousand times. Look for resource limits too, such as page size, upload size and expensive queries.
For a multi-tenant product, we run the first check across every tenant pair and every role pair, not just a sample. Both checks are set out in full in our API testing checklist.
04 / What we find
Weaknesses that recur in Bengaluru developer-facing APIs
Developer-facing APIs share a short list of recurring weaknesses.
Show details for Weaknesses that recur in Bengaluru developer-facing APIs
- A tenant identifier the client controls. A header or path segment that selects the tenant and is trusted without checking it against the key.
- Keys with no expiry and no scope. A single key that reads, writes and administers, issued once and never rotated.
- Bulk endpoints without ceilings. Export and list routes that return everything for any page size.
- Verbose error bodies. Stack traces and query text in responses to malformed requests.
- Old versions left running. A first version of the API that skips the checks added to the third.
- Assistant endpoints with a service account. A chat or agent route that reads any customer's data because it runs with broad rights.
Each is easy to fix once seen, which is why the report gives the request that shows the problem next to the change that closes it.
Several of these are cheap to fix and expensive to ignore, because a customer who finds one in their own review tends to wonder what else was missed. Fixing them before a customer's security team looks is usually the better commercial decision, and a dated report shows the fixes were made on purpose.
05 / Rules and customers
What Bangalore customers ask about an API
Integration reviews are short and specific.
Show details for What Bangalore customers ask about an API
An enterprise customer integrating with your API often sends a short list: how keys are issued and revoked, how tenants are separated, how limits work, how you log access and when the API was last tested by someone independent. A report that answers those questions in its summary saves weeks. SOC 2 does not require a penetration test. Its criteria ask for controls that find and manage vulnerabilities, penetration testing is one common way to show that, and your auditor decides what evidence is enough.
The newer questions concern AI features. Customers have begun to cite OWASP's GenAI lists, which cover LLM applications, agentic applications and MCP servers; see our article on tools and AI in testing for how we treat them. We test the API layer around an assistant, which is where access control fails, and we do not sell AI red teaming as a separate service.
06 / How it runs
How an API test fits a Bangalore release plan
Everything happens over documents and calls, so your release dates set the schedule.
Show details for How an API test fits a Bangalore release plan
Before day 1
Scope by call
We pin down the environments, the API versions, the tenant model and any planned release, and record the dates and the build to be reported on.
Day 1
Tenants, keys and docs
You give us two tenants, keys at each plan level and role, and the specification. We confirm access and tell you which addresses our traffic will come from.
Days 2 to 7
Testing the product's promises
We test tenant separation, scopes, limits and the AI endpoints, replaying each call across tenants and plans, and we flag urgent findings immediately.
OutputCalls that reproduce each finding
07 / Questions to ask
What to ask before you pick an API tester
These separate a tester who understands multi-tenant products from one who runs a scanner.
Show details for What to ask before you pick an API tester
- Will you test every pair of tenants and plans, or one example of each?
- How do you find API versions and hosts that our documentation does not list?
- Do you replay calls across keys and roles by hand, or only scan for known patterns?
- How will you treat our assistant and tool endpoints, and what will you not test?
- Can you give us each finding as a request we can replay?
08 / Delivery
Delivery of API tests for Bangalore products
Where the work happens
Testing is run from our office in Yellareddyguda, Hyderabad, which is our only office. Outside Hyderabad nothing about these tests needs us in your building; if a customer or a site rule asks for someone present, we come by arrangement and write the travel cost into the proposal.
What you receive
One report is written for management, customers and auditors, and a second, more technical one for the engineers who make the fixes. A walkthrough call covers both, and after your fixes we retest and mark each finding closed or open. Every inquiry gets a reply: we respond within 24 hours.
How to prepare
Test accounts, a staging address, our testing addresses allowed through your firewall and a named contact are what we ask for. The preparation article explains each item, and the one-page checklist (PDF) is a printable version.
09 / Price
API testing prices for Bengaluru products
An API product test sits in the larger band (from INR 27,000 + 18% GST), and endpoints, tenants, roles and environments move the figure. The API testing cost guide has the detail.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
10 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Do you test AI assistant and tool endpoints?
We test them as part of the API layer: who can call them, with what scope, what they can reach and how they handle hostile input in data. We do not offer separate AI red-team exercises. See the section on What Bangalore customers ask about an API above.
Can you test tenant separation across plans and keys?
Yes. With tenants and keys at each plan level, we replay calls across every pair and report any request, export or job that crosses a boundary. See the section on What a Bangalore API test looks at first above.
Is a remote API test as thorough as an on-site one?
For APIs, yes. The work is requests and responses, and nothing about it needs a visit. See the section on Delivery of API tests for Bangalore products above.
Which OWASP list do you use for APIs?
OWASP's API Security Top 10 in its 2023 edition, still current in November 2026, together with the web Top 10:2025 for anything that belongs there. See the section on From our guide: authorization and limits above.
Can you test our public documentation and sandbox?
Yes. We compare what is documented with what answers, look for hidden routes and real data in sandboxes, and check error messages. See the section on What a Bangalore API test looks at first above.
What does it cost?
An API of this kind begins from INR 27,000 + 18% GST, then moves with endpoints, tenants and roles. See the section on API testing prices for Bengaluru products above.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana