The best API security testing tool depends on what you have. If you have an OpenAPI file, Schemathesis, RESTler and ZAP's API scan can generate tests from it for free. Burp Suite DAST, StackHawk and 42Crunch add dashboards, CI controls and contract checks as commercial products.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation, as of 19 October 2026.
Key takeaways
- Most API test tools start from a schema, so a current OpenAPI definition is the single best input you can give them.
- Schema driven fuzzers find server errors and validation gaps. Authorization flaws such as BOLA need tests that know your users and roles.
- Shadow APIs (endpoints nobody documented) are invisible to schema tools by definition.
- Run API tests against staging with test accounts.
What do people ask about API security testing?
The same few questions come up: what to test first, whether a scanner can find broken authorization, how to test GraphQL, and whether free tools are enough. The OWASP API Security Top 10 (2023) is the usual checklist: broken object level authorization, broken authentication, broken object property level authorization, unrestricted resource consumption, broken function level authorization, unrestricted access to sensitive business flows, server side request forgery, security misconfiguration, improper inventory management and unsafe consumption of APIs.
How do the tools compare?
| Tool | Type | Input (per docs) | What it does |
|---|---|---|---|
| Schemathesis | Open source | OpenAPI 2.0 to 3.2, GraphQL | Generates property based tests; finds server errors, schema violations and validation gaps; includes a curl reproducer |
| RESTler | Open source, MIT | OpenAPI JSON or YAML | Stateful REST fuzzing; reports HTTP 500 responses as bugs; checkers for resource leaks and hierarchy violations |
| ZAP API scan | Free and open source | OpenAPI or GraphQL (GraphQL needs 2.9.0 or later) | Actively scans the described API; runs in Docker and GitHub Actions |
| Burp Suite DAST | Commercial | Postman Collections, OpenAPI, SOAP WSDL, GraphQL | Authenticated scans in CI, merge gating by severity |
| StackHawk | Commercial | Config pages for OpenAPI, GraphQL, gRPC, JSON-RPC, SOAP | HawkScan runs locally or in CI |
| 42Crunch | Commercial | OpenAPI contract | Audit (static contract test), Scan (runtime) and Protect (runtime allowlist) |
| Invicti | Commercial | Running web apps and APIs | Claims shadow API discovery and BOLA and BFLA detection |
What are the strengths and limits?
Schemathesis reduces the tests you write by hand. It works from the command line and with pytest. Its docs focus on server errors and schema violations, so pair it with an authorization test plan.
RESTler chains requests by inferring producer and consumer dependencies, so it can reach states a single request cannot. The README says it was created at Microsoft Research and is still under active development.
ZAP is the lowest cost way to put an API scan in CI. Its API scan loads a definition from a file or URL.
42Crunch splits the work by stage. Its audit tests the contract before any implementation exists, and its scan exercises the running API to confirm it matches the contract. That is useful if you design APIs contract first.
Invicti, Burp Suite DAST and StackHawk matter most when you need central reporting across many teams.
How do I choose an API security testing tool?
- Do you have an accurate OpenAPI, GraphQL or Postman definition for every API?
- Does the tool support your auth (Bearer, API key, OAuth)?
- Can it test with two users to check object level access?
- Does it handle your protocols: REST, GraphQL, gRPC, SOAP?
- Can it run in CI and fail a build on a clear rule?
- How will you find endpoints that are not in the schema?
- Where do findings go, and who owns the fix?
How do I find APIs that are not documented?
Look at what the front end actually calls. Safeguard has written about API endpoints hidden in JavaScript. For the dependency side of an API service, the free scan at gold.safeguard.sh/scan checks up to 100 dependencies in your browser with no login.
Frequently asked questions
What is the best free API security testing tool?
For schema driven testing, Schemathesis, RESTler and ZAP are all free. Try them on the same OpenAPI file and compare the findings.
Can DAST test APIs?
Yes. ZAP, Burp Suite DAST and StackHawk each document API scanning from a schema or collection.
Can a scanner find broken object level authorization?
Rarely out of the box. It needs to know which user owns which object, so plan targeted tests with two accounts.
Do I need an OpenAPI file?
Not strictly, but most tools here work from one, and coverage is only as good as the file.
Sources
- Schemathesis docs: https://schemathesis.readthedocs.io/en/stable/
- RESTler: https://github.com/microsoft/restler-fuzzer
- ZAP Docker packaged scans: https://www.zaproxy.org/docs/docker/about/
- Burp Suite DAST: https://portswigger.net/burp/dast
- StackHawk docs: https://docs.stackhawk.com/
- 42Crunch: https://42crunch.com/
- Invicti: https://www.invicti.com/
- OWASP API Security Top 10 2023: https://api-security.owasp.org/editions/2023/en/0x11-t10
- Free dependency scan: https://gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
