Skip to content
SPECIFICTION
Get listed

APISec Platform

apisec.ai

From $690/mo Free plan WebLinuxAPISelf-hostedBrowser extension
Visit apisec.ai
Spec score 9.4 #2 of 27 in API Security Testing Software

What it is

APISec Platform is an application security tool for validating exploits against APIs and applications. It discovers applications, builds a dynamic model of their behavior, and runs attacker-like tests at runtime. The model can capture endpoints, parameters, authentication flows, roles, permissions, object ownership, and business logic without documentation or developer interviews. Tests cover business logic, data access, permissions, configuration, infrastructure, and controls such as injection and token handling. For validated exploits, the platform returns the request sequence, data reached, blast radius, replay, and a suggested resolution. APISec says it can find APIs across infrastructure, source, gateways, ingress and authentication paths, web apps, development tools, and CI/CD, as well as agents, MCP servers, and LLM call sites. Public APIs run against its cloud; private and on-premises APIs can use a Kubernetes or Docker container, while cloud deployments can run in a customer’s GCP, Azure, or AWS environment. The free plan covers public API testing and basic simulations. Standard costs $690 a month per 100 endpoints; Pro costs $2,750 a month per 100 endpoints.

Spec sheet

What it does
APISec continuously discovers applications, models their behavior, and validates exploitable API weaknesses with replayable proof.Read 15 Oct 2026 · apisec.ai
Product
APISec describes its platform as an AI-based AppSec platform for application exploit validation that discovers applications, models how they work, and executes attacker-like tests at runtime.Read 29 Sep 2026 · apisec.ai
Deployment
Public APIs run against APISec’s public cloud; private and on-premises APIs can use an APISec Kubernetes or Docker container, and cloud deployments can run in the customer’s GCP, Azure, or AWS environment.Read 29 Sep 2026 · apisec.ai
Integrations
Configuration supports report, issue-tracker, notification, playbook-backup, and single-sign-on integrations.Read 15 Oct 2026 · docs.apisec.ai
Support
The pricing page lists community support for Free, dedicated support for Standard, and premium support for Pro; the support page offers email, LinkedIn, Discord, courses, and FAQ links.Read 29 Sep 2026 · apisec.ai
Founded
2018Read 28 Sep 2026 · apisec.ai
Company
APISec says it was created in 2018 and identifies the company as APIsec, Inc.Read 29 Sep 2026 · apisec.ai
API formats
API registration accepts OpenAPI, Swagger, Postman, and RAML documents from a URL or uploaded file.Read 15 Oct 2026 · docs.apisec.ai
API-first
The FAQ says nearly every aspect of the product is exposed as an API for custom automations and integrations.Read 29 Sep 2026 · apisec.ai
Application model
Its application model captures endpoints, parameters, authentication flows, roles, permissions, object ownership, and business logic dynamically without requiring documentation or developer interviews.Read 29 Sep 2026 · apisec.ai
Attack coverage
The platform tests business logic, data access, roles and permissions, application configuration, infrastructure, and security controls such as injection and token handling.Read 29 Sep 2026 · apisec.ai
Automated attack generation
The documentation says APISec generates thousands of test cases tailored to each API architecture.Read 15 Oct 2026 · docs.apisec.ai
Behavioral learning
APISec learns roles, tokens, object ownership, and allowed or disallowed behavior to test business logic and authorization.Read 15 Oct 2026 · apisec.ai
Browser extension
APIsec BOLT passively captures browser API traffic locally, detects authentication details, generates OpenAPI specifications, and can onboard captured applications for scans.Read 15 Oct 2026 · chromewebstore.google.com
Company identity
The legal entity is APIsec Inc., headquartered at One Sansome Street, Suite 3500, San Francisco, California.Read 15 Oct 2026 · apisec.ai
Company profile
LinkedIn lists APIsec as privately held, founded in 2018, headquartered in San Francisco, and employing 11–50 people.Read 15 Oct 2026 · linkedin.com
Data-use terms
The terms state that APISec will not sell, rent, or lease service data and reserve the company’s intellectual-property rights in the service.Read 15 Oct 2026 · apisec.ai
Developer examples
The public examples repository provides Python and shell workflows to register applications, manage instances, trigger scans, and use personal-access-token authentication in CI/CD.Read 15 Oct 2026 · github.com
Discovery
The platform discovers APIs across source code, gateways, ingress, authentication paths, web applications, Postman, SwaggerHub, Insomnia, CI/CD, agents, MCP servers, and LLM call sites.Read 15 Oct 2026 · apisec.ai
Documentation depth
The documentation includes API registration, CLI endpoint addition, API calls, dashboards, categories, integrations, and configuration procedures with curl examples.Read 15 Oct 2026 · docs.apisec.ai
Exploit proof
The platform returns validated exploits with the request sequence, data reached, blast radius, replay, and suggested resolution.Read 29 Sep 2026 · apisec.ai
Exploit validation
Results include evidence of what was exploitable, replay information, and remediation context rather than only potential findings.Read 15 Oct 2026 · apisec.ai
Funding
Dealroom records a July 2018 $2.0 million seed investment from Canaan and describes the company as a San Francisco cloud API-security provider.Read 15 Oct 2026 · app.dealroom.co
GitHub integration
GitHub can receive vulnerability issues and can store or restore APISec playbooks through personal-access-token or SSH credentials.Read 15 Oct 2026 · docs.apisec.ai
Integrations and discovery
APISec says it discovers APIs across infrastructure, source, gateways, ingress and auth paths, web apps, Postman, SwaggerHub, Insomnia, and CI/CD, including agents, MCP servers, and LLM call sites.Read 29 Sep 2026 · apisec.ai
Jira integration
The Jira connector can create vulnerability tickets after APISec validates findings and can transition tickets when later scans confirm fixes.Read 15 Oct 2026 · docs.apisec.ai
Limit: customization and complexity
Gartner reviewers cite limited customization, clutter when many scan results appear, heavy setup for smaller teams, and remediation guidance that may lack step-by-step detail.Read 15 Oct 2026 · gartner.com
Limit: enhancement charges
SoftwareReviews lists charges for enhancements as a recurring negative theme.Read 15 Oct 2026 · softwarereviews.com
Limit: onboarding and reporting
G2 reviewers mention a learning curve, requests for better in-app guidance and advanced documentation, limited report customization, and occasional false positives or result delays.Read 15 Oct 2026 · g2.com
Open-source tools
APISec Surface includes local discovery tools, GitHub Actions, and a browser extension; the page lists MIT licenses for AI Surface and MCP audit, and Apache 2.0 for the Bolt Browser Extension.Read 29 Sep 2026 · apisec.ai
Plan constraint
Pricing is per 100 endpoints in increments, with custom pricing for on-premises and private API testing; the FAQ says hosted agents can validate private APIs.Read 29 Sep 2026 · apisec.ai
Praise: automation and usability
G2 reviewers repeatedly praise continuous automated scanning, CI/CD integration, intuitive dashboards, actionable reports, and responsive support.Read 15 Oct 2026 · g2.com
Praise: coverage and integration
Gartner reviewers praise automated API lifecycle coverage, OWASP and business-logic analysis, continuous testing, CI/CD fit, and risk visibility.Read 15 Oct 2026 · gartner.com
Praise: value and support
SoftwareReviews feedback highlights comprehensive testing, ease of integration, vendor support, productivity, and perceived cost effectiveness.Read 15 Oct 2026 · softwarereviews.com
Private deployment
Private and on-premises APIs can run through APISec Kubernetes or Docker containers, while customer-cloud deployments can use customer credentials.Read 15 Oct 2026 · apisec.ai
Public API
APISec states that nearly every product capability is exposed through an API for custom automation and integrations.Read 15 Oct 2026 · apisec.ai
Rating on Capterra
4.7 out of 5 from 3 reviewsRead 15 Oct 2026 · capterra.com
Rating on Chrome Web Store
5.0 out of 5 from 12 ratingsRead 15 Oct 2026 · chromewebstore.google.com
Rating on G2
4.7 out of 5 from 229 reviewsRead 15 Oct 2026 · g2.com
Rating on Gartner Peer Insights
4.4 out of 5 from 21 ratingsRead 15 Oct 2026 · gartner.com
Rating on GetApp
4.7 out of 5 from 3 reviewsRead 15 Oct 2026 · getapp.com
Rating on SoftwareReviews
7.5 out of 10 from 6 reviewsRead 15 Oct 2026 · softwarereviews.com
Scanner architecture
The scanner is a lightweight Docker container that receives tasks from the control plane over SSL and runs playbooks.Read 15 Oct 2026 · docs.apisec.ai
Security and privacy
The free, open-source APISec Surface discovery tool runs in the user’s environment and states that nothing leaves the machine.Read 29 Sep 2026 · apisec.ai
Security categories
Security categories generate endpoint tests in tiers covering server configuration, unauthenticated endpoints, authenticated users, and multi-step role or logic scenarios.Read 15 Oct 2026 · docs.apisec.ai
Security safeguards
The privacy policy says APISec uses industry-standard administrative, physical, and technical safeguards and retains customer data and credentials up to 365 days after termination unless deletion is requested sooner.Read 15 Oct 2026 · apisec.ai
Sensitive-data detection
The service flags sensitive data in API specifications, with default PII detection and configurable patterns or regular expressions.Read 15 Oct 2026 · apisec.ai
Support SLA
APISec promises an initial response to support requests within 24 hours but does not guarantee resolution times.Read 15 Oct 2026 · apisec.ai
Surface open-source tools
The separate APISec Surface product is free, runs offline, and includes MIT- and Apache-licensed discovery tools such as AI Surface and the BOLT browser extension.Read 15 Oct 2026 · apisec.ai
Vault
APISec Vault stores API keys, credentials, tokens, passwords, and key-value pairs for read-only use by test playbooks.Read 15 Oct 2026 · docs.apisec.ai

Plans and prices

Free Free $0 forever Public API testing · Basic test simulations · Community support · Dashboard access Read 15 Oct 2026 · apisec.ai
Standard $690 a month $690/mo · per 100 endpoints or $8,275/yr Continuous automated validation · Business-logic attacks · Continuous API testing · Team collaboration · Dedicated support Read 15 Oct 2026 · apisec.ai
Pro $2,750 a month $2,750/mo · per 100 endpoints or $33,075/yr Standard features · CI/CD and ticketing integrations · Custom attack simulations · Advanced reporting and SLAs · White-glove onboarding · Premium support Read 15 Oct 2026 · apisec.ai
Bug Bounty Priced on request Custom pricing Certified expert reports · Manual and ad-hoc deep dives · Private and public API testing · Authentication support Read 15 Oct 2026 · apisec.ai

Every APISec Platform plan and price →

Strong points and limits

Strong points

  • Models application behavior without documentation or interviews
  • Returns replayable details for validated exploits
  • Tests business logic, permissions, and security controls
  • Free plan includes public API testing
  • Supports container and customer-cloud deployments

Limits

  • Free plan is limited to public API testing
  • Standard costs $690 a month per 100 endpoints
  • Pro costs $2,750 a month per 100 endpoints
  • Pricing is per 100 endpoints in increments

Who it suits

It suits teams that need automated API exploit validation, including testing of authentication, authorization, and business logic. Its container and customer-cloud deployment options may suit teams testing private or on-premises APIs.

APISec Platform in depth

Read the full write-up

Overview

APISec Platform is an application security platform that maps application behavior and runs attacker-like tests against it. It is best suited to teams that need to validate API exploits, especially where permissions and business logic matter. Its evidence-rich results are compelling, but endpoint-based pricing and deployment choices should shape the buying decision.

Key features

APISec builds a dynamic application model of endpoints, parameters, authentication flows, roles, permissions, object ownership, and business logic without requiring documentation or developer interviews. That makes it useful when API behavior is more complete than its written specifications; teams looking only for document-based checks may not need this broader runtime approach.

Testing reaches business logic, data access, roles and permissions, configuration, infrastructure, and controls such as injection and token handling. A validated exploit comes with its request sequence, the data it reached, its blast radius, replay, and a suggested resolution. This makes findings more useful for reproduction and remediation than a bare alert, though it still requires teams to assess the suggested fix in their own context.

Discovery can draw from infrastructure, source, gateways, ingress and authentication paths, web apps, Postman, SwaggerHub, Insomnia, and CI/CD, including agents, MCP servers, and LLM call sites. Supported formats include OpenAPI Specification, Swagger, Postman, and RAML. The platform exposes nearly every aspect through an API, which suits teams building custom automation and integrations.

Public APIs run against APISec’s public cloud. Private and on-premises APIs can be tested using an APISec Kubernetes or Docker container, while cloud deployments can run in the customer’s GCP, Azure, or AWS environment. Hosted agents can also validate private APIs. That range helps accommodate different environments, but private and on-premises testing has custom pricing.

The separate APISec Surface discovery tool runs locally and states that nothing leaves the machine. It includes local discovery tools, GitHub Actions, and a browser extension; AI Surface and MCP audit carry MIT licenses, while the Bolt Browser Extension is Apache 2.0. This is a distinct option for teams focused on local API discovery rather than the platform’s runtime validation.

Pricing

The Free plan costs nothing, billed $0 forever, with no credit card required. It includes public API testing, basic test simulations, dashboard access, and community support. It is a sensible starting point for exploring the product, but it does not include the continuous validation and team features of paid plans.

Standard costs $690 a month, billed $690/mo, per 100 endpoints, or $8,275/yr. It adds continuous automated validation and API testing, business-logic attacks such as BOLA and RBAC, team collaboration, and dedicated support. This is the paid entry point for teams seeking ongoing validation, but endpoint increments mean the price scales with the scope under test.

Pro costs $2,750 a month, billed $2,750/mo, per 100 endpoints, or $33,075/yr. It includes everything in Standard plus full CI/CD and ticketing integrations, custom attack simulations, advanced reporting and SLAs, white-glove onboarding, and premium support. It fits teams that need those integrations and service commitments; otherwise Standard covers the stated continuous-testing core at a lower price.

Bug Bounty has custom pricing. It offers certified expert reports, manual and ad-hoc deep dives, private and public API testing, and authentication support, making it the option for periodic assurance rather than continuous automated validation. Pricing is per 100 endpoints in increments, while on-premises and private API testing use custom pricing.

Platforms

APISec supports API, extension, Linux, self-hosted, and web environments. The deployment model is consequential: public APIs use APISec’s public cloud, while private and on-premises testing can use Kubernetes or Docker containers, and customer-cloud deployment supports GCP, Azure, and AWS.

Who it's for

APISec is strongest for security and engineering teams responsible for APIs with meaningful authorization rules or business logic, and for organizations that need replayable evidence of what an exploit can reach. Teams automating their security workflows can benefit from its API-first design. It is a weaker fit for buyers who only need basic schema checks or whose endpoint count and private deployment needs make endpoint-based or custom pricing unsuitable.

Pros and cons

Pros

Dynamic modeling covers permissions and business logic without requiring API documentation or developer interviews.

Validated exploits include replay and impact context, helping teams reproduce and prioritize findings.

Multiple private deployment paths and customer-cloud options can accommodate different API environments.

API access across nearly every product aspect supports custom automation and integrations.

Cons

Paid pricing is tied to endpoint increments, so expanding coverage can increase costs.

Private and on-premises testing has custom pricing, making those deployments less straightforward to budget.

The free plan is limited to public API testing and basic simulations, without the continuous validation and collaboration features in Standard.

Alternatives

42Crunch API Security Platform is worth considering if a free starting point centered on an AI coding plugin, OpenAPI audit, vulnerability scans, and automatic fixes is a better match.

Parasoft SOAtest is an alternative for teams seeking tailored pricing based on business needs.

Pynt offers a free Starter plan capped at 10 API endpoints, making it a lower-scope option for small API inventories.

AquilaX API Security Scanner has a free plan with secrets scanning, PII detection, compliance auditing, unlimited scans, and CI/CD and IDE integrations.

Pentest-Tools.com API Scanner is an alternative whose NetSec plan starts at $95 a month with five assets, with price varying by asset count and billing cycle.

Beagle Security offers a free plan with one lite test per month, monthly surface scan reports, and SSL and domain expiry monitoring.

OWASP Amass is a free, open-source framework for users seeking that kind of tool instead.

VulnAPI is a free MIT-licensed alternative for educational and testing use.

Browse API Security Testing Software or API Security Software for more options.

Verdict

Choose APISec if your team needs continuous, runtime API validation that maps business behavior and produces reproducible exploit evidence. Its strongest reason to buy is the combination of dynamic modeling, broad attack coverage, and actionable results. Look elsewhere if basic checks are enough, or if per-endpoint and custom deployment pricing do not fit your budget.

Verdict

APISec combines dynamic application modeling with runtime testing and evidence for validated exploits. Check endpoint-based pricing and the deployment requirements for private APIs against your intended use.

Where Specifiction places it

Alternatives to APISec PlatformAll alternatives →