API penetration-testing prices cannot be compared by endpoint count alone. One operation may return public reference data; another may approve a payout across several services. Roles, object relationships, token flows, protocol types and downstream effects determine the real testing work.
For an Indian procurement, create one API scope pack and require every provider to explain its effort model. This separates a reasoned quotation from a low per-endpoint number that excludes authorization, business logic or service-to-service trust.
Count operations, not only paths
A path with GET, POST, PATCH and DELETE represents different authority and input. Versions, content types, bulk routes and administrative variants add coverage even when the URL looks similar.
Provide an OpenAPI or equivalent inventory, but ask vendors how they validate it against observed traffic and clients. Undocumented operations and alternate hosts can materially change the quote.
- Method-and-path combinations by version.
- Bulk, export, upload and callback operations.
- Public, partner, internal and administrative hosts.
- Deprecated or undocumented routes in scope.
Price the identity matrix
Authorization testing multiplies operations by meaningful caller and object relationships. State user, service, partner and administrator roles, plus tenant and ownership models.
A quote based on one bearer token does not cover BOLA, BFLA or cross-tenant behaviour. Ask candidates which comparisons are full coverage, risk-based sampling or excluded.
- Anonymous and authenticated callers.
- Owner, peer, delegated and privileged object relationships.
- Multiple organisations or tenants.
- Workload and machine identities.
Describe authentication and token lifecycles
OAuth, OIDC, JWT, API keys, HMAC signing, mutual TLS and proprietary sessions require different setup and abuse tests. Include authorization server, clients, grants, scopes, audiences and key ownership.
Lifecycle work includes enrolment, exchange, refresh, rotation, revocation, logout and role change. If the buyer supplies a static token, vendors may omit the very flows that establish authority.
- Client types, grants and redirect paths.
- Scope, audience and consent model.
- Key rotation and revocation behaviour.
- Step-up or transaction-specific authorization.
Map business workflows across calls
An API operation is often one transition in onboarding, payment, approval, export or fulfilment. List critical journeys and final effects so vendors can test order, replay, concurrency and invalid transitions.
Pricing only isolated request validation produces shallow coverage. Ask how much analyst time is assigned to stateful abuse and how evidence reaches the authoritative downstream result.
- High-impact state machines.
- Idempotency and retry behaviour.
- Asynchronous completion and reconciliation.
- Alternate channels reaching the same effect.
Include protocol and interface diversity
REST, GraphQL, gRPC, WebSocket, webhooks and event interfaces need different tooling and reasoning. State which are externally reachable and which require internal access.
GraphQL cost is shaped by schema, operations, resolvers, federation and cost controls, not one `/graphql` endpoint. Streaming and subscription interfaces add long-lived identity and event-authorization tests.
- Schema or contract availability.
- Query, mutation and subscription surface.
- Binary protocols and generated clients.
- Webhook authenticity and replay controls.
Expose microservice trust boundaries
A public gateway may fan out to many services. Describe gateway policy, direct routes, trusted headers, workload identity, service mesh and tenant propagation.
Ask whether the provider will test only the edge or also internal calls. Internal testing can require network access, service accounts, observability and coordination, all of which affect effort and price.
- Gateway-to-service identity propagation.
- Direct service exposure and alternate routes.
- Service-account privilege and secret handling.
- Cross-service authorization and confused-deputy paths.
Account for documentation and readiness
Accurate specifications, collections, sample payloads and seeded accounts reduce discovery time. Missing or stale documentation shifts effort into inventory construction and may leave uncertain coverage.
Define who resolves schema errors, access failures and unstable data. A readiness checkpoint before billing protects both buyer and provider.
- Machine-readable contracts and environment URLs.
- Representative data and role-specific accounts.
- Known rate limits and safety ceilings.
- Technical owner available during execution.
Choose the test depth and evidence standard
State whether the engagement includes automated baseline checks, manual authorization, business logic, token review, configuration or source assistance. The same operation count can support very different assurance.
Require request-and-response evidence, control cases, caller-object context and final effects. Coverage matrices and engineering readouts require real delivery effort but make findings actionable.
- Risk-based versus exhaustive operation coverage.
- Manual identity and object comparisons.
- Architecture or source-assisted analysis.
- Coverage, findings and retest evidence.
Control potentially expensive safety conditions
APIs can trigger email, payment, jobs, rate-limit alarms and downstream integrations. Specify safe accounts, test values, concurrency ceilings, excluded operations and emergency contacts.
Production restrictions can slow testing but protect the business. A quote that ignores these controls may be operationally unusable.
- Destructive and financial operations.
- Resource-exhaustion and concurrency boundaries.
- Third-party quota or cost exposure.
- Cleanup and reconciliation obligations.
Normalize the commercial comparison
Ask for price components: discovery, base API test, specialist protocols, internal microservices, report, workshops, retest and options. Capture GST, travel, data-location and subcontractor assumptions.
Challenge materially different quotes with a written coverage reconciliation. Do not infer that the highest endpoint count or lowest unit price offers the best assurance.
- Freeze the operation, identity and workflow baseline.
- Compare included depth and consciously sampled areas.
- Add retest, options, tax and likely change costs.
- Select on evidence quality and total closure value.
Use a buyer-owned cost equation
Model effort as operation families multiplied by identity and object comparisons, then add workflow, protocol and service-boundary complexity. Adjust for readiness, safety, reporting and retest.
The model need not predict a universal rate. It creates a common language for asking why quotations differ and what assurance is removed when budget changes.
Use the OWASP API Security Top 10 2023 for risk vocabulary and NIST SP 800-115 for assessment planning and reporting. For token scope, consult the OAuth 2.0 Security Best Current Practice. Obtain current quotations rather than relying on a universal price claim.
Make the API price traceable to authority
API cost becomes intelligible when the buyer describes who can call what, against whose object, in which state and through which service path. Endpoint count then becomes context rather than a misleading shortcut.
WIMD scopes API assessments around operations, identities, tokens, objects, workflows, protocols and trust boundaries, producing quotations that can be compared without sacrificing the controls buyers actually need tested.