Questions, answered.
The short version. For pricing specifics see the pricing page, and for anything else, talk to us.
Getting started
What is an endpoint?
A specific path and method combination within your API, for example GET /user. We count that as one testable endpoint.
What if I don’t know how many endpoints I have?
No problem. Plans are priced in 100-endpoint increments, so it’s easy to start small and grow into more when you need them.
What counts as an application?
One application is one OpenAPI / Swagger definition. A microservices app is multiple smaller OpenAPI / Swagger files. Pricing is per application; see the pricing page for current rates.
Do I need a credit card to sign up?
No. You can get started with a free account or a free trial.
How do I cancel?
Monthly subscriptions can be cancelled anytime by sending a request to support@apisec.ai.
Coverage and testing
Can I test a private API?
Yes. Hosted agents let you validate private APIs.
Can apisec run a black-box test, or is authentication required?
A limited set of tests can run without authentication, useful for initial data gathering. apisec delivers the most value with multiple roles and tenants, where RBAC and ABAC validation shine, so we recommend providing authentication to see the full picture.
My API has only one endpoint. Is that enough for a proof of value?
With a single endpoint you’ll mostly exercise injection-type attacks. A more complex API lets apisec run a much broader range of attack scenarios, so it’s a better proof of value.
What kind of API is best for a proof of value?
One with (1) different methods (read, write, modify), (2) different tenants or users to test ABAC, and (3) different roles to test RBAC.
Do you cover more than the OWASP API Top 10?
Yes. apisec ships with a large library of attack categories out of the box, built from analysis of real-world API breaches, and you can customize or add your own.
Do I have to manually declare what each role is allowed to do?
No. apisec learns the allowed and disallowed behavior for the roles you provide. Through a simple workflow you validate what we’ve learned, then confirm the API behaves the way you intend for each role. Access-control validation is a feature customers really value.
Which versions of OpenAPI and Swagger do you support?
All versions.
Does apisec identify sensitive data from the spec?
Yes. apisec flags sensitive data in the specification (PII by default), and the definition of “sensitive” can be customized using patterns or regular expressions.
Deployment and integrations
What are the deployment options?
Public APIs run against the apisec public cloud. Private, on-premises APIs run via an apisec Kubernetes or Docker container (we provide setup instructions). For APIs in your own cloud (GCP, Azure, AWS), apisec can deploy into your environment using your credentials.
Do you charge per integration?
No. Integrations come out of the box with the Pro edition.
Is there an API to build custom automations and integrations?
Yes. apisec is built API-first, and nearly every aspect of the product is exposed as an API.
Will apisec consume a lot of gateway transactions when it runs?
Most customers run apisec against staging or nightly-build environments, which typically don’t carry the per-transaction pricing of production gateways.