Skip to content
SPECIFICTION
Get listed

apPosture API Security

apposture.com

From $2.92/mo WebLinuxAPISelf-hosted
Visit apposture.com
Spec score 8.7 #5 of 30 in API Security Software

What it is

apPosture API Security inventories API endpoints, assigns risk priorities, and compares declared API contracts with running APIs. Its risk verdict combines whether an endpoint is public, handles sensitive data, and lacks provable authentication. Endpoint labels distinguish code-and-runtime provenance, source-only findings, and runtime-only observations. Discovery uses SAST attack-maps, DAST crawling, an attached OpenAPI specification, and external subdomain probing; listed coverage includes OpenAPI import, GraphQL, gRPC, HTTP/2, h2c, and REST. Teams can diff an OpenAPI specification against running endpoints to identify documented, shadow, declared-untested, and auth-drift states. Runtime correlation ingests existing access logs out of band rather than inline in the request path. The product supports API-scoped compliance across seven frameworks and SARIF export. It can run self-hosted, in a customer's cloud, or as a dedicated managed instance; self-hosted deployment uses a local LLM and needs no outbound connections after setup. The listed Essentials plan is $35 a year, billed at $35 / dev · mo annually, with a $2,000 / year minimum; API Security is an additional $15 / dev · mo. Platform is $70 a year, billed at $70 / dev · mo annually, with a $4,000 / year minimum. Enterprise is $90 a year, billed at $90 / dev · mo annually, with a $7,500 / year minimum. There is no free tier; each edition starts with the same 30-day proof of concept.

Spec sheet

What it does
apPosture is a self-hosted application-security posture platform that discovers applications, APIs, code, dependencies, containers, Kubernetes, cloud accounts, infrastructure-as-code, secrets and AI/ML assets, then correlates results into one posture.Read 15 Oct 2026 · docs.aspm.apposture.com
Purpose
API Security inventories endpoints, scores risk on an A–F curve, surfaces toxic combinations, and compares declared API contracts with running APIs.Read 7 Oct 2026 · apposture.com
Deployment
Deployments run self-hosted through Docker Compose, in the customer’s cloud account or as a dedicated managed instance.Read 15 Oct 2026 · apposture.com
Integrations
Supported source-control connections include GitHub, GitHub Enterprise, GitLab, GitLab self-managed, Bitbucket and Azure DevOps.Read 15 Oct 2026 · apposture.com
Compliance
API Security offers API-scoped compliance across seven frameworks and supports SARIF export.Read 7 Oct 2026 · apposture.com
Support
Every license includes email support, documentation, security advisories and upgrade guidance; Enterprise adds a named technical contact and custom response SLA.Read 15 Oct 2026 · apposture.com
Headquarters
Baku, AzerbaijanRead 28 Sep 2026 · apposture.com
Air-gapped operation
The platform is designed to run offline with a local model, no required telemetry and no required outbound connection.Read 15 Oct 2026 · apposture.com
API authentication
Programmatic access uses scoped, revocable bearer tokens with the apt_ prefix; browser sessions use JWTs and MFA.Read 15 Oct 2026 · docs.aspm.apposture.com
API CI controls
API findings can enforce a CI score gate, export SARIF and map to seven compliance frameworks.Read 15 Oct 2026 · apposture.com
API discovery sources
Endpoint discovery uses SAST attack maps, DAST crawls, attached OpenAPI specifications and external subdomain probing.Read 15 Oct 2026 · apposture.com
API inventory
API Security inventories endpoints and assigns each a single A-F risk grade.Read 15 Oct 2026 · apposture.com
CI/CD integrations
CI/CD gating supports GitHub, GitLab, Jenkins, Azure DevOps and Bitbucket, with Monitor-to-Block operation.Read 15 Oct 2026 · apposture.com
Code and runtime
Endpoints are labeled Code + Runtime, From source, or Runtime-only to show code-to-runtime provenance.Read 7 Oct 2026 · apposture.com
Code-to-runtime
Endpoints are labelled as Code plus Runtime, source-only or runtime-only to expose shadow APIs.Read 15 Oct 2026 · apposture.com
Compliance mapping
Findings are mapped to OWASP Top 10, PCI-DSS v4, ISO 27001, SOC 2, NIST 800-53, HIPAA and GDPR.Read 15 Oct 2026 · apposture.com
Contract comparison
Users can attach an OpenAPI specification and compare declared endpoints with running traffic for documented, shadow, declared-untested and auth-drift states.Read 15 Oct 2026 · apposture.com
Contract diff
An attached OpenAPI specification can be diffed against running endpoints to surface documented, shadow, declared-untested, and auth-drift states.Read 7 Oct 2026 · apposture.com
Data handling
In self-hosted and customer-cloud deployments, apPosture says it never receives source code, scan data or findings.Read 15 Oct 2026 · apposture.com
Deployment and privacy
The platform can run self-hosted, in the customer's cloud, or as a dedicated managed instance; self-hosted deployment uses a local LLM and does not require outbound connections after setup.Read 7 Oct 2026 · apposture.com
Discovery
Endpoint discovery draws on SAST attack-maps, DAST crawling, an attached OpenAPI specification, and external subdomain probing.Read 7 Oct 2026 · apposture.com
Documentation depth
The documentation includes quick start, installation, platform architecture, API Security, CI/CD, governance, reporting, administration and troubleshooting sections.Read 15 Oct 2026 · docs.aspm.apposture.com
License model
The terms state that apPosture is licensed rather than sold and is authorized for defensive security testing.Read 15 Oct 2026 · apposture.com
Limit: no free tier
The pricing page states there is no free tier; every option starts with a 30-day proof of concept.Read 15 Oct 2026 · apposture.com
Limit: regional pricing
Published prices are for the local market; separate EU and GCC lists apply and are invoiced in local currency.Read 15 Oct 2026 · apposture.com
Limit: URL metering
DAST and Agentic Pentest are metered by registered target URL, and the vendor does not offer an unlimited target allowance.Read 15 Oct 2026 · apposture.com
LinkedIn company size
LinkedIn lists the company size as 2–10 employees.Read 15 Oct 2026 · linkedin.com
LinkedIn founding year
LinkedIn lists apPosture as founded in 2024.Read 15 Oct 2026 · linkedin.com
LinkedIn headquarters
LinkedIn lists Baku as the headquarters location.Read 15 Oct 2026 · linkedin.com
LinkedIn industry
LinkedIn categorizes apPosture as a Computer and Network Security company.Read 15 Oct 2026 · linkedin.com
LinkedIn ownership
LinkedIn identifies apPosture as privately held.Read 15 Oct 2026 · linkedin.com
LinkedIn product scope
LinkedIn describes the offering as enterprise ASPM with agentic pentest, AutoFix, API, cloud and Kubernetes posture, and air-gap readiness.Read 15 Oct 2026 · linkedin.com
LinkedIn WAAP claim
The LinkedIn profile also describes a self-hosted WAAP with WAF, API endpoint discovery, shadow and zombie API detection, bot/DDoS defense and graduated allow-to-block enforcement.Read 15 Oct 2026 · linkedin.com
Maker headquarters
The company lists Jeyhun Salimov 53, Baku, Azerbaijan as its address.Read 15 Oct 2026 · apposture.com
Maker legal name
The registered entity is apPosture MMC.Read 15 Oct 2026 · apposture.com
Notable update
The July 25, 2026 documentation update added cloud posture, AI Security, Breach and Attack Simulation, mobile security details and a scored API Security discipline.Read 15 Oct 2026 · docs.aspm.apposture.com
Notifications
Alerts can be routed to email, Slack, Microsoft Teams, Telegram, PagerDuty, Opsgenie and HMAC-signed webhooks.Read 15 Oct 2026 · apposture.com
OpenAPI explorer
Each installation provides an auto-generated Swagger/OpenAPI explorer at /api/v1/docs.Read 15 Oct 2026 · docs.aspm.apposture.com
Protocols
Listed API coverage includes OpenAPI import, GraphQL, gRPC, HTTP/2, h2c, and REST.Read 7 Oct 2026 · apposture.com
Protocols supported
API coverage lists OpenAPI import, GraphQL, gRPC, HTTP/2, h2c and REST.Read 15 Oct 2026 · apposture.com
REST API
The product exposes a REST API under /api/v1 with about 390 endpoints across roughly 60 modules.Read 15 Oct 2026 · docs.aspm.apposture.com
Risk prioritization
Public, sensitive, and not-provably-authenticated endpoint properties combine into one prioritized “Risky” verdict.Read 7 Oct 2026 · apposture.com
Runtime correlation
API Security correlates existing access logs out of band rather than sitting inline in the request path.Read 15 Oct 2026 · apposture.com
Runtime data
Runtime correlation ingests existing access logs out of band rather than inline in the request path.Read 7 Oct 2026 · apposture.com
SDKs and CLI
Documentation links a CLI and CI Agent, while the API page describes typed OpenAPI schemas rather than published SDK packages.Read 15 Oct 2026 · docs.aspm.apposture.com
Security controls
Listed controls include scoped RBAC, checksum-pinned CI agents, signed integrations, encrypted credentials, fail-closed gates and append-only audit logs.Read 15 Oct 2026 · apposture.com
Ticketing integrations
Two-way issue synchronization is listed for Jira Cloud/DC, ServiceNow, GitHub, GitLab, Azure DevOps and custom REST.Read 15 Oct 2026 · apposture.com
Toxic combinations
The product prioritizes endpoints that are public, sensitive and not provably authenticated as one risky verdict.Read 15 Oct 2026 · apposture.com
Trial and pricing limit
Pricing states there is no free tier and that each edition starts with the same 30-day proof of concept; API Security is included in Platform and Enterprise, or listed as a $15 / dev · mo add-on.Read 7 Oct 2026 · apposture.com

Plans and prices

API Security add-on $15 a month per developer/month OWASP API Top 10 · schema drift · runtime inventory; included on Platform+ Read 15 Oct 2026 · apposture.com
Essentials $35 a year $35 / dev · mo, billed annually SAST · SCA · Secrets · IaC · Container · DAST add-on per URL · API Security +$15 / dev · mo · $2,000 / year minimum Read 7 Oct 2026 · apposture.com
Essentials $35 a month billed annually; minimum $2,000/year SAST · SCA · Secrets · IaC · Container · AI fix PRs · Monitor CI/CD gate · DAST add-on per URL · community support Read 15 Oct 2026 · apposture.com
Platform $70 a year $70 / dev · mo, billed annually Includes API Security · DAST, 5 target URLs · 8×5 priority support · $4,000 / year minimum Read 7 Oct 2026 · apposture.com
Platform $70 a month billed annually; minimum $4,000/year Everything in Essentials · 5 DAST target URLs · API security · cloud posture · ASPM attack-chain correlation · Block gate and PR decoration · SSO OIDC/SAML and SCIM · 8×5 priority support Read 15 Oct 2026 · apposture.com
Enterprise $90 a month billed annually; minimum $7,500/year Everything in Platform · 10 target URLs with Agentic Pentest · STRIDE threat modeling · RBAC and multi-tenant · fail-closed gate · Evidence Vault · auditor portals · air-gapped included · 24×7 SLA and CSM Read 15 Oct 2026 · apposture.com
Enterprise $90 a year $90 / dev · mo, billed annually Includes API Security · DAST, 10 target URLs · 24×7 + SLA + dedicated CSM · $7,500 / year minimum Read 7 Oct 2026 · apposture.com
Agentic Pentest uplift $600 a year per DAST target URL/year Hypothesis generation and agentic exploitation on an existing dynamic-testing target Read 15 Oct 2026 · apposture.com
DAST target URL $900 a year per registered target URL/year Crawl · active scan · deterministic proof; 5 URLs included on Platform and 10 on Enterprise Read 15 Oct 2026 · apposture.com
One-off engagement $900, paid once one target; no subscription Dynamic testing plus Agentic Pentest and full report Read 15 Oct 2026 · apposture.com

Every apPosture API Security plan and price →

Strong points and limits

Strong points

  • Covers OpenAPI, GraphQL, gRPC, HTTP/2, h2c, and REST.
  • Out-of-band runtime correlation avoids inline request processing.
  • Self-hosting uses a local LLM without post-setup outbound connections.
  • Supports API-scoped compliance across seven frameworks.
  • Integrates with listed CI/CD, cloud, and collaboration tools.

Limits

  • No free tier is listed.
  • Essentials has a $2,000 / year minimum.
  • API Security is a $15 / dev · mo add-on on Essentials.
  • Runtime protection is listed as no.

Who it suits

It suits security teams that need endpoint discovery, risk prioritization, and contract comparisons across APIs. Deployment options include self-hosting, a customer's cloud, and a dedicated managed instance.

Verdict

apPosture API Security combines endpoint inventory, risk scoring, and specification comparison with several deployment options. Check which plan includes the product and how its per-developer pricing and minimums fit your deployment.

Where Specifiction places it

Alternatives to apPosture API SecurityAll alternatives →