Overview
What is an API security assessment?
An API security assessment tests the interfaces your applications, mobile apps and partners use to exchange data, to find weaknesses an attacker could use. Ants Creation (Pvt) Ltd’s own security team carries it out under a written authorisation and an NDA.
APIs often expose more than the screens built on them. We check who can call each endpoint, what data it returns, how it handles unexpected input, and whether it can be flooded or misused.
You receive a report rating each finding by severity, with the steps to fix it, and one re-test after the fixes.
What is included
What does an API security assessment test?
How it works
How does an API security assessment work?
01
Scope and authorise
The systems in scope and the testing window are set out in a written authorisation you sign, alongside an NDA.
02
Map
We map the target and how it is used, so testing covers what matters.
03
Test
We look for weaknesses and confirm, safely, which ones are real.
04
Report
Each finding is rated by severity, with the evidence and the steps to fix it.
05
Re-test
After you fix the issues, one re-test of the fixed issues is included.
Why Ants Creation
Why test your APIs with Ants Creation?
Since 2011, Ants Creation has completed 700+ projects for 400+ clients in Sri Lanka and abroad.
Common questions
API security assessment: frequently asked questions
Which APIs do you test?
Ants Creation’s security team tests REST APIs used by web applications, Android apps and integrations with partners. We check who can call each endpoint, what data it returns, how it handles unexpected or malicious input, and whether it can be flooded or misused. The APIs and endpoints in scope are agreed when we scope the work and set out in your signed authorisation.
Do you need documentation?
It helps. API documentation or a set of example requests lets Ants Creation’s security team cover every endpoint, including ones the application’s screens rarely use. What you can provide is agreed when we scope the work; if documentation is not available, tell us then, and we will agree with you how the endpoints in scope are identified before testing starts.
Can you test the API behind our mobile app?
Yes. Ants Creation’s security team can test the API behind your mobile app on its own, or as part of a mobile application security assessment of an Android app, where the app and its servers are checked as one system. The APIs an app relies on often hold the real risk. The app assessment itself covers Android apps only.
What happens after the report?
The report rates each finding by severity, with the evidence and the steps to fix it. You, or Ants Creation’s developers, who design and integrate APIs every day, fix the issues, starting with the most serious. Our security team then re-tests the fixed issues once, included in the assessment, to confirm each issue is closed.
Related services
Tell us what you need.
Tell us what you need, and we will recommend the right next step. No obligation, no sales script.