Skip to content
SPECIFICTION
Get listed

Pentest-Tools.com API Scanner

pentest-tools.com

From $95/mo Free trial WebmacOSLinuxAPI
Visit pentest-tools.com
Spec score 7.8 #8 of 22 in Offensive Security

What it is

Pentest-Tools.com API Scanner is a cloud service for assessing APIs and detecting vulnerabilities such as SQL injection, SSRF, local file inclusion, code injection, and request URL override. It supports REST and GraphQL APIs, Postman Collections, and OpenAPI 2 and 3 specifications in YAML, YML, or JSON. Authenticated scans can use request headers, including Basic Authorization and JWT tokens. Reports include risk summaries, vulnerability evidence, remediation advice, and a list of more than 40 tests; export options vary by plan and include PDF, HTML, CSV, XLSX, or editable DOCX. Listed integrations include Jira, Slack, Microsoft Teams, Discord, webhooks, Nucleus, Vanta, Burp Suite, AWS, Azure Marketplace, GitHub Actions, and a REST API. A free plan is available. Paid plans start at $95 per month; API scanning is limited in NetSec and included in WebNetSec. The seven-day full-scanner trial requires a business email and card, and costs nothing if canceled before day eight. The company says customer data is encrypted at rest and in transit, and reports are deleted 30 days after generation.

Spec sheet

Purpose
The online API Vulnerability Scanner assesses APIs and detects vulnerabilities including SQL injection, SSRF, local file inclusion, code injection, and request URL override.Read 29 Sep 2026 · pentest-tools.com
Intended users
The company describes its tools as made for penetration testers and other information security professionals, and the API scanner page names offensive and defensive security teams and system builders or administrators as users.Read 29 Sep 2026 · pentest-tools.com
Integrations
The platform lists Jira, Slack, Microsoft Teams, Discord, webhooks, Nucleus, Vanta, Burp Suite, AWS, Azure Marketplace, GitHub Actions, and a REST API among its integrations.Read 29 Sep 2026 · pentest-tools.com
Headquarters
Bucharest, Romania, EuropeRead 28 Sep 2026 · pentest-tools.com
Founded
2017Read 28 Sep 2026 · pentest-tools.com
Authentication
Authenticated scans can use request headers with methods including Basic Authorization and JWT tokens.Read 29 Sep 2026 · pentest-tools.com
Data protection
The company says customer data is encrypted at rest with AES-256 and in transit with TLS 1.2+, and reports are automatically deleted 30 days after generation.Read 29 Sep 2026 · pentest-tools.com
Hosting and residency
The product runs in Hetzner and Linode data centers in the EU, UK, Iceland, and US; new customers can choose US or Europe data hosting.Read 29 Sep 2026 · pentest-tools.com
Plan limits
Pricing states that API scanning is limited in NetSec and included in WebNetSec, while all plans include API access and unlimited scans on assets.Read 29 Sep 2026 · pentest-tools.com
Reports
Reports include risk summaries, vulnerability evidence, remediation advice, and a list of 40+ tests; exports vary by plan and include PDF, HTML, CSV, XLSX, or editable DOCX.Read 29 Sep 2026 · pentest-tools.com
Security certification and privacy
PentestTools SA says it is certified to ISO/IEC 27001:2023 and processes customer data under GDPR.Read 29 Sep 2026 · pentest-tools.com
Specification support
It supports OpenAPI versions 2 and 3 in YAML, YML, and JSON formats.Read 29 Sep 2026 · pentest-tools.com
Supported APIs
The scanner works on REST APIs, GraphQL APIs, and Postman Collections.Read 29 Sep 2026 · pentest-tools.com
Trial terms
The full scanner trial lasts 7 days, requires a business email and card, and costs nothing if canceled before day 8.Read 29 Sep 2026 · pentest-tools.com

Plans and prices

NetSec $95 a month From $95/month with 5 assets; price varies by asset count and billing cycle. Network scanning · cloud scanning · password auditing · reconnaissance · limited web and API scanning Read 29 Sep 2026 · pentest-tools.com
WebNetSec $140 a month From $140/month with 5 assets; price varies by asset count and billing cycle. Everything in NetSec · DAST · authenticated web scans · REST and GraphQL API scanning · CMS scanning Read 29 Sep 2026 · pentest-tools.com
Pentest Suite $190 a month From $190/month with 5 assets; price varies by asset count and billing cycle. Everything in WebNetSec · automated CVE exploitation · SQL injection and XSS exploiters · pentest report generator Read 29 Sep 2026 · pentest-tools.com

Every Pentest-Tools.com API Scanner plan and price →

Strong points and limits

Strong points

  • Supports REST, GraphQL, and Postman Collections.
  • Authenticated scans can use headers and JWT tokens.
  • Reports include evidence and remediation advice.
  • Integrates with Jira, Slack, and GitHub Actions.
  • A free plan is available.

Limits

  • API scanning is limited in NetSec.
  • The seven-day trial requires a business email and card.
  • Trial costs nothing only if canceled before day eight.
  • Paid plans start at $95 per month.

Who it suits

It is aimed at penetration testers and other information security professionals, as well as offensive and defensive security teams and system builders or administrators. It fits users assessing REST or GraphQL APIs and Postman Collections.

Verdict

The scanner supports several API specification formats and authenticated scans, with detailed reports and many listed integrations. Check plan-level API access and trial terms before choosing it.

Where Specifiction places it

Alternatives to Pentest-Tools.com API ScannerAll alternatives →