API security from the specification to what is live.
F Creative Studio 360 helps organisations in any country find, test and protect the interfaces their applications, partners and customers actually call.
An API is a door with its own rules.
A website test does not show whether one customer can read another customer’s record, whether a query can ask for the entire store, or whether an old version is still answering. Those are properties of the interface.
F Creative Studio 360 scopes that work to the interfaces you own, in whichever country they are hosted. A client environment is only touched when that organisation has authorised it.
- The interface is the product
- Mobile apps, partners and other services all reach you through an API. A control that only watches the website will not see that traffic.
- Authorisation is where the damage sits
- A valid login is not the same as permission to read someone else’s record, change a price, or call a function meant for an administrator.
- APIs appear faster than the inventory
- Old versions, internal endpoints and undocumented interfaces stay reachable. You cannot protect a list you do not have.
- The same work in any country
- The engineering questions do not change with the office. The evidence is written for the obligations that apply where you operate.
What the work covers
Testing is mapped to the OWASP API Security Top 10. Specifications are reviewed as OpenAPI. Access design follows OAuth 2.0 and OpenID Connect.
- REST
- Resource interfaces checked for authentication, what each caller is allowed to do, how much data comes back, and whether the business rules hold.
- GraphQL
- A review of what the schema exposes, how deep a query may go, and whether one request can ask for far more than the client should receive.
- gRPC
- Service definitions, transport security, and whether each method checks the caller before it acts on the message.
- WebSocket
- Long-lived connections checked for who may open them, whether messages can be altered, and what happens when a session should have ended.
- Discovery and inventory
- Find the interfaces that are actually exposed, including ones that are undocumented or left over from an older version, and compare them with the specification.
- Authorised testing
- Manual and automated testing of the interfaces you put in scope, mapped to the OWASP API Security Top 10, including business rules a scanner will not understand.
- Checks in the pipeline
- Review of the OpenAPI description, and gates that run before a change is released, so a broken contract is caught while it is still a change.
- Gateway and access
- How the gateway is configured: who can call what, how keys and tokens are issued, and whether limits exist. A denial-of-service test is not part of a standard engagement.
How an engagement runs
The sequence is the same in any country. What changes is which interfaces are in scope, and which obligations the report is written for.
- 1
List what is exposed
Accounts, gateways, specifications and live traffic, so shadow and retired interfaces are visible.
- 2
Agree the scope
Which interfaces may be tested, with what credentials, and what must not be touched. Production is included only when you authorise it.
- 3
Test what was agreed
Authentication, authorisation, the data returned, and the business actions a caller should not be able to take.
- 4
Put the check in the pipeline
A gate on the specification and on the build, so the same class of issue is less likely to ship again.
- 5
Watch what is live
Monitoring of the interfaces that remain in production, when that is part of the engagement.
What you receive
- An inventory of the interfaces in scope, including ones that were not in the documentation.
- Findings rated by impact, with evidence a developer can reproduce inside the agreed rules.
- Notes on the gateway, tokens and what each caller is allowed to do.
- A gate for the pipeline, when that is part of the engagement.
- A record you can show a customer or an auditor.
Common questions
What does API security cover?+
F Creative Studio 360 finds the interfaces you expose, tests the ones you authorise, and helps you put checks into the way those interfaces are designed and released. That includes REST, GraphQL, gRPC and WebSocket, and the gateway in front of them.
Where do you deliver this?+
For organisations in any country. The technical work is the same. Reporting follows the obligations that apply where you operate.
How is this different from a penetration test?+
A penetration test can include APIs when they are in scope. This service stays with the interfaces: inventory, the specification, authorisation, the gateway, and checks that run as the API changes. Testing is part of it. It is not the whole of it.
Will you test production?+
Only when that is written into the scope. Anything that could interrupt the service, including a denial-of-service test, is left out of a standard engagement.
What if we do not have a complete list of APIs?+
That is a common starting point. Discovery is the first step, so old versions and undocumented interfaces are on the list before anyone argues about which findings matter.
How much does it cost?+
It depends on how many interfaces are in scope, whether the work is discovery, a test, pipeline gates, or ongoing review. A scoping conversation with F Creative Studio 360 is the way to get a quote. There is no obligation to proceed.
Start with the interfaces you already expose.
F Creative Studio 360 will look at the specifications, the gateway and the reason for the work, then say whether the next step is an inventory, a test, or checks in the pipeline.