API penetration testing.
Every auth mode, verified.

API Pentesting questions

• Common objection We already have a scanner — why add another tool?

  Most scanners score findings probabilistically, which is why AppSec queues grow faster than they shrink. Pentrova puts a finding in your queue only once AI review of the evidence captured from your target confirms it, so you are not adding a second queue — you are retiring the unconfirmed half of the first one. The product is engineered so backlog should shrink as Pentrova lands, not expand.
• Common objection Aren't you too expensive compared to free open-source tools?

  Free scanners are excellent at what they do. Pentrova replaces the human hours teams spend triaging and reproducing probabilistic findings, not the scanners themselves. The pricing is set so a confirmed finding costs less than the engineering time a queue of unconfirmed alerts would consume.
• Common objection DAST scanners are too noisy — what stops Pentrova from drowning us in alerts?

  Where a request is safe to repeat (GET and HEAD), our verifier replays the candidate finding from a clean session and compares the signal that flagged it — status code, response body hash, sensitive byte sequences, error patterns — against a clean baseline. That replay and the rest of the evidence captured from your target go to AI review, and only findings it confirms become tickets. Unconfirmed candidates never enter the queue.
• Which API specification formats does API Pentesting accept?

  OpenAPI 2/3/3.1, Postman Collections v2.1, GraphQL schemas (introspected or uploaded), Protobuf service definitions, and WSDL documents. Specs can be uploaded directly or pulled from a private URL at scan time.
• How does API Pentesting handle authentication?

  Six modes are supported out of the box: bearer, API key, basic, OAuth 2.0, custom script-driven schemes such as HMAC / AWS SigV4, and mutual TLS. Token refresh, short-lived credentials, and rotated keys are handled automatically.
• Does API Pentesting support GraphQL subscriptions and persisted queries?

  Yes. Pentrova discovers subscription fields alongside queries and mutations, and it accepts persisted-query IDs and a hashing salt when your gateway requires them.
• Can Pentrova test gRPC APIs?

  Yes. Upload the .proto definitions or enable server reflection; Pentrova will exercise unary, server-streaming, client-streaming, and bidi-streaming methods with realistic payloads derived from the message types.
• How does API Pentesting handle broken object-level authorization (BOLA)?

  Every API engagement runs the Authorization Matrix to replay requests across roles, flag privilege bypasses on identifier fields, and surface the reference-response comparison alongside the exploit evidence — see /product/platform#authorization-matrix.
• What does an API Pentesting finding look like?

  Every finding in your queue was confirmed by AI review of evidence captured from your API. Where a finding has a captured HTTP exchange (request and response, headers and body), you can copy it as a cURL command or raw HTTP, or download it as Markdown or HAR, and re-send it without Pentrova tooling. Pentrova masks the secrets it recognises in exports; it does not remove personal data.