API penetration testing.
Every auth mode, verified.

API Pentesting questions

• Common objection We already have a scanner — why add another tool?

  Most scanners score findings probabilistically, which is why AppSec queues grow faster than they shrink. Pentrova only publishes findings our verifier can reproduce, so you are not adding a second queue — you are retiring the unreproducible half of the first one. The product is engineered so backlog should shrink as Pentrova lands, not expand.
• Common objection Aren't you too expensive compared to free open-source tools?

  Free scanners are excellent at what they do and we ship our own four free tools for that reason. Pentrova replaces the human hours teams spend triaging and reproducing probabilistic findings, not the scanners themselves. The pricing is set so a verified PoC bundle costs less than the engineering time a probabilistic queue would consume.
• Common objection DAST scanners are too noisy — what stops Pentrova from drowning us in alerts?

  Every candidate finding is replayed in a clean session by our verifier and the differential signal that flagged it — status code, response body hash, sensitive byte sequences, error patterns — is compared against a clean baseline before it becomes a ticket. Findings whose differential does not reproduce never enter the queue. In practice that turns the "noise vs signal" ratio into a binary gate: if the differential reproduces, it is signal.
• Which API specification formats does API Pentesting accept?

  OpenAPI 2/3/3.1, Postman Collections v2.1, GraphQL schemas (introspected or uploaded), Protobuf service definitions, and WSDL documents. Specs can be uploaded directly or pulled from a private URL at scan time.
• How does API Pentesting handle authentication?

  Six modes are supported out of the box: bearer, API key, basic, OAuth 2.0, custom script-driven schemes such as HMAC / AWS SigV4, and mutual TLS. Token refresh, short-lived credentials, and rotated keys are handled automatically.
• Does API Pentesting support GraphQL subscriptions and persisted queries?

  Yes. Pentrova discovers subscription fields alongside queries and mutations, and it accepts persisted-query IDs and a hashing salt when your gateway requires them.
• Can Pentrova test gRPC APIs?

  Yes. Upload the .proto definitions or enable server reflection; Pentrova will exercise unary, server-streaming, client-streaming, and bidi-streaming methods with realistic payloads derived from the message types.
• How does API Pentesting handle broken object-level authorization (BOLA)?

  Every API engagement runs the Authorization Matrix to replay requests across roles, flag privilege bypasses on identifier fields, and surface the reference-response comparison alongside the exploit evidence — see /product/platform#authorization-matrix.
• What does an API Pentesting finding look like?

  Every finding ships with the captured HTTP exchange (request headers, body, response headers, body), the exploitation reasoning, a sanitized PoC, and a reproducible curl command so engineering can replay the finding without Pentrova tooling.