APIPosture vs Checkmarx API Security
APIPosture
apiposture.comCheckmarx API Security
checkmarx.comSide by side
| Figure | APIPosture | Checkmarx API Security |
|---|---|---|
| Price from | $9/mo | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | Yes | — |
| Web | — | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 4 | 6 |
| Spec score · API Security Software | 9.3 (#2) | 8.3 (#6) |
| Compliance | The pricing page labels SOC 2 Type II audited and compliant, GDPR ready, and ISO 27001 in progress. | The trust center states ISO/IEC 27001:2022 certification, annual independent SOC 2 Type II audits, GDPR alignment, and NIST SSDF alignment. |
| Purpose | APIPosture performs static source-code analysis to identify potential API security and configuration issues. | Checkmarx API Security discovers APIs in application code and documentation, including undocumented shadow APIs and abandoned zombie APIs. |
| Rating on G2 | 5.0 out of 5.0 from 1 review | 4.2 out of 5 from 49 reviews |
| What it does | APIPosture performs local static analysis of API source code to discover endpoints and identify authorization and security risks. | Checkmarx API Security inventories APIs from source code and documentation and correlates API risks with runtime testing in Checkmarx One. |
Plans
APIPosture
- Community EditionFree
- Pro Solo$9 a month
- Pro Team$22 a month
- Enterprise$150 a month
Checkmarx API Security
- Checkmarx One bundlePriced on request
- EnterprisePriced on request
- EssentialsPriced on request
- ProfessionalPriced on request
- Start with SASTPriced on request
- Start with Supply ChainPriced on request
In their own words
APIPosture
APIPosture is a self-hosted static source-code analysis tool for identifying potential API security and configuration issues. The maker says scans run locally on a machine or CI/CD runner, with code, findings, and project data not sent to external servers. Its free Community Edition is an open-source CLI with eight authorization rules, AP001–AP008, covering issues such as unintended public access and missing authorization on writes. Supported languages include.NET, Go, Python, Node.js, Java, and PHP, with frameworks including ASP.NET Core, FastAPI, Express, Spring Boot, and Laravel. GitHub Actions, GitLab CI, and Azure DevOps integrations include an option to fail builds when critical vulnerabilities are detected. Pro adds OWASP Top 10 rules, deep source and file scanning, and more than 30 secrets detection patterns. Pro Solo costs $9 a month, billed annually at $108/year. Automated analysis does not guarantee detection of every vulnerability or security issue. Bug reports go through GitHub issues and feature requests through GitHub Discussions.
Checkmarx API Security
Checkmarx API Security discovers APIs in application source code and documentation, including undocumented shadow APIs and abandoned zombie APIs. It builds a global inventory showing vulnerabilities and supports remediation prioritization by business risk. The scanner supports Java Spring, ASP.NET Web API and Python Flask, and examines OpenAPI, Swagger and Postman collections for documentation mismatches. An API Change Log records history, including the commit and developer linked to a vulnerability-introducing change. Checkmarx DAST findings can be correlated with SAST findings in the same inventory to identify runtime-confirmed issues. Integrations include GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, GitHub Actions, VS Code, JetBrains, Jira, Slack and Microsoft Teams. Security statements cover AES-256 encryption at rest, HTTPS with TLS 1.2, annual SOC 2 Type II audits and GDPR-aligned privacy practices. Deployment is cloud or hybrid. Pricing is custom, based on modules, deployment model and developers in scope; no self-serve trial is offered.