API security testing in Kochi
Across Kochi, APIs move room inventory to booking partners, shipment status to customers, lab results into hospital apps and loan data between lenders. We test them from Hyderabad, with and without a login, and begin by listing the feeds nobody wrote down.
- Typical duration
- 5 to 10 working days
- Testing
- Manual, by engineers
- Report
- Executive + engineering
- Delivery
- Remote from Hyderabad, visits by arrangement
Last reviewed
01 / Local need
Why Kochi companies need their APIs tested
Feeds between companies are how Kochi's trade works, and each feed is an interface that can be misused.
A hotel group pushes rates and availability to travel partners through interfaces it set up once. A freight forwarder exposes shipment status to customers and receives bookings from agents. A hospital's patient app calls the same back end its front desk uses, and an NBFC receives leads and sends repayment data through partner endpoints. These interfaces grow quietly, and the people who built them are often at an agency rather than in the company.
That is why the first call is usually a walk through what exists: hosts, versions, partner credentials and who maintains each. Testing then proceeds from Hyderabad, with a trip to Kochi only if scoping shows a reason. Our API security testing page explains the technique, and VAPT services in Kochi speaks to the local buyer.
A practical tip for the scoping call: bring whoever answers when a partner phones with a problem. That person usually knows which feeds are fragile, which credentials were shared in a hurry and which partner once asked for something unusual, and that knowledge shortens the inventory step considerably.
02 / Scope
APIs we test most often for Kochi companies
Six kinds of interface cover most of the API work we scope here.
Rate and availability feeds
Interfaces that push room rates and inventory to booking partners. We try each partner credential for what it can read or alter, and whether a partner can overwrite rates that belong to someone else.
Shipment status and booking APIs
Calls that return tracking data and accept bookings from agents. We test authorization on each shipment, document downloads and the limits on lookups.
Hospital app backends
The calls a patient app makes. We replay them with another patient's identifiers, without a token and with a staff token, to see what the server really enforces.
Lender and lead-exchange APIs
Endpoints for partner leads, KYC checks and repayment data. We check signatures, replay protection and what is returned beyond what the partner needs.
Payment callbacks
Messages from gateways that mark a booking or a repayment as paid. We test verification, amount matching and whether a message can be replayed or forged.
Forgotten versions and hosts
A first release left running for one partner, or a staging gateway on the open internet. They surface from apps, scripts and public records, and join the scope once you agree.
03 / From our guide
From our guide: tokens, webhooks and outgoing calls
Partner feeds and callbacks decide most Kochi API reports. This is the part of our checklist that covers how tokens are handled and how messages in both directions are verified.
Authentication and tokens
- Are tokens signed with a strong algorithm and verified on every request?
- Do they expire, and does logout invalidate them on the server?
- Is there a limit on login, password reset and one-time passcode attempts?
- Are API keys scoped, rotated and kept out of mobile app packages?
GraphQL, webhooks and the calls you make
GraphQL needs its own checks: introspection, deeply nested queries, batching to get around rate limits, and authorization on every resolver. Webhooks need signature checks and replay protection. The 2023 list also covers unsafe consumption of other APIs, so check what your server does with a response from a partner or vendor.
Where a travel or lending partner's message triggers money or inventory changes, we test the verification step first. The inventory, authorization and limits checks are in the full API checklist.
04 / What we find
Weak points we expect in Kochi partner and shipment APIs
Feeds built for trust between companies tend to share a few weaknesses.
Show details for Weak points we expect in Kochi partner and shipment APIs
- One key for every partner. A single credential shared by several travel agents, so that nobody can tell who changed a rate or revoke one without cutting off all.
- Unsigned callbacks. A payment-success message accepted because it came from the expected address, with no signature to check.
- Tracking data with extras. A status call that returns consignee names, phone numbers and invoice values the customer never needed.
- Booking calls without limits. An endpoint that accepts hundreds of holds a minute, which ties up inventory at no cost to an attacker.
- Old versions still answering. A first release kept alive for a single partner, missing the checks added later.
- Verbose failures. Error bodies that reveal table names, partner codes or internal hostnames.
Most are quick to fix once seen, and the report orders them by the number of partners each change protects.
Shared feeds also deserve a short written record of who may change what. Many Kochi teams discover during scoping that two or three people each believe a partner key belongs to someone else. Settling ownership is not a test finding, yet it is often the first fix, and the report notes it where it applies so that every interface has a named owner afterwards, whether that is your team or an agency.
05 / Rules and customers
What drives API testing for Kochi companies
Partners, regulators and clients abroad each ask about the same interface in their own way.
Show details for What drives API testing for Kochi companies
Travel partners and large customers ask how feeds are protected before they connect. Where an API carries patient, guest or borrower records, India's DPDP Act applies, and its rules begin in 2027; see our DPDP checklist. Lenders work to their regulator's own directions, which belong on your compliance team's desk, and card data that crosses an API brings PCI DSS into play.
Findings are usually mapped to OWASP's API Security Top 10, whose current edition dates from 2023, and our walk-through of that list explains every entry.
06 / How it runs
How an API test fits Kochi's partner feeds
Because the interfaces belong to several parties, the early steps are about who may approve what.
Show details for How an API test fits Kochi's partner feeds
Before day 1
Inventory and permissions
On a call we list every host, version and feed, note which belong to an agency or a partner, and record who may approve a change or a test of each.
Day 1
Credentials per partner type
You provide a test credential for each kind of partner and for each internal role, with whatever specification exists. We check that calls succeed.
Days 2 to 7
Replaying calls across credentials
We test object and function authorization, callbacks, limits and data exposure by hand, and report anything serious the same day.
OutputRequests that reproduce each finding
07 / Questions to ask
Questions worth asking an API tester for a partner-heavy business
Interfaces shared between companies need a tester who can work around other people's permissions.
- How do you exercise a partner credential while staying clear of the partner's own systems?
- Will you verify our callbacks, including forged and repeated messages?
- Can you find feeds and versions that nobody documented?
- What will you need from an agency that maintains one of our interfaces?
- Can the report rank fixes by how many partners each one covers?
08 / Delivery
Delivery of API tests to Kochi companies
Where the work happens
Testing is run from our office in Yellareddyguda, Hyderabad, which is our only office. Outside Hyderabad nothing about these tests needs us in your building; if a customer or a site rule asks for someone present, we come by arrangement and write the travel cost into the proposal.
What you receive
One report is written for management, customers and auditors, and a second, more technical one for the engineers who make the fixes. A walkthrough call covers both, and after your fixes we retest and mark each finding closed or open. Every inquiry gets a reply: we respond within 24 hours.
How to prepare
Test accounts, a staging address, our testing addresses allowed through your firewall and a named contact are what we ask for. The preparation article explains each item, and the one-page checklist (PDF) is a printable version.
09 / Price
What an API test costs in Kochi
The size of an API test follows its interfaces, partner types and roles, and it begins from INR 27,000 + 18% GST. A lone hospital app backend is priced differently from a travel platform with dozens of partner feeds, and the proposal puts the figure on paper. Our API cost guide breaks it down.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
10 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Can you test feeds that an agency maintains for us?
Yes, with written agreement from you and the agency. The agency provides access and applies fixes, and we report to you. See the section on Questions worth asking an API tester for a partner-heavy business above.
Do you test the messages our payment gateway sends us?
Yes. We check that each callback is verified, that its amount matches the booking or repayment, and that a repeated or forged message is rejected. See the section on APIs we test most often for Kochi companies above.
Can you test a patient app's API with fictional patients?
Yes. We ask for test accounts and, where possible, a demo dataset, and we replay the app's calls across users and roles. See the section on APIs we test most often for Kochi companies above.
Which OWASP list do you map API findings to?
To the API Security Top 10 (2023 edition), which remains the latest in November 2026, with the web Top 10:2025 added where a finding fits it. See the section on What drives API testing for Kochi companies above.
Is a trip to Kochi needed for an API test?
Almost never. It needs credentials, documents and a person to ask, all of which work on a call. See the section on Delivery of API tests to Kochi companies above.
What should we budget?
An API test begins from INR 27,000 + 18% GST, then follows interfaces, partner types and environments. See the section on What an API test costs in Kochi above.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana