What an API penetration test costs in Europe, and what moves the number

A test is priced in days, not in endpoints

Almost every European testing firm builds its price the same way: a number of tester-days multiplied by a day rate, plus a fixed allowance for reporting and a retest if you buy one. Endpoint counts, user counts and traffic volumes only matter because they change the number of days. Once you internalize that, a quotation stops being a black box and becomes two numbers you can question separately.

This also explains why quotations diverge so wildly. A vendor charging €700 a day and quoting six days lands at €4,200. A vendor charging €1,600 a day and quoting twelve lands at €19,200. Both may be honest. They are selling different amounts of a different-quality hour, and the only way to see it is to ask both for the day count and the rate separately.

What European testers publish

These are other companies’ own published figures, collected in September 2026. They are useful as benchmarks for reading a quotation. None of them is a quote for your API, and all of them are subject to change by the firms that published them.

Two things stand out. The effort bands from different firms agree closely, which suggests they reflect how long the work genuinely takes rather than what the market will bear. The day rates do not agree at all, varying by a factor of nearly three across the same continent. Effort is physics; rate is positioning.

The seven drivers, and what each one costs you

Every scoping questionnaire is asking about the same seven things. Here is what each one does to the day count, and why.

1. Endpoints or operations

The unit that matters is the operation, not the path. One resource exposed with five verbs is five tests, because authorization is frequently applied per verb and not per route. A GraphQL schema with 200 fields and 40 mutations is not one endpoint, whatever your gateway dashboard says. Ask a vendor how they count, because a quote based on paths against a schema-based API will be short by days.

2. Roles and tenancy

This is the driver most people underestimate. The authorization matrix grows with roles multiplied by object types, so a fourth role costs more testing time than fifty additional read-only endpoints. Multi-tenancy adds an entire second axis: every cross-tenant check has to be run with two live tenants, because a single tenant cannot demonstrate isolation. If you only change one line in your scoping document after reading this guide, make it the role count, and make it accurate.

3. Authentication schemes

One static API key is an afternoon. OAuth2 with three grant types, rotating refresh tokens, scope-based authorization and mutual TLS for partner traffic is a phase of its own, and each scheme needs its own working credentials before testing starts. The OpenAPI specification makes this easy to communicate: its securitySchemes object supports apiKey, http, mutualTLS, oauth2 and openIdConnect, and handing over that block tells a tester your auth model in one glance.

4. API styles in scope

REST, GraphQL, gRPC, WebSocket and webhooks need different tooling and different abuse tests. GraphQL brings introspection, aliasing, batching and query-depth work that has no REST equivalent. gRPC brings reflection and protobuf handling. Webhooks bring signature verification and replay. A mixed estate costs more than the endpoint count suggests, because the tester changes toolchain between them.

5. Environments

Staging with production-like data volumes is the cheapest place to test resource consumption, because nobody has to negotiate a window. Production adds scheduling, throttling, a named contact, a kill switch and usually a conversation with whoever owns the on-call rota. Testing production only, with no staging at all, adds days and constrains what can be attempted, which quietly reduces coverage.

6. Specification quality

A current OpenAPI document or GraphQL schema can remove two days of discovery. No specification at all adds them back and, worse, adds uncertainty: at the end of the engagement neither side can state confidently what proportion of the surface was reached. Cloudflare found organizations had roughly a third more public-facing API endpoints than their own inventories listed. If your specification is stale, budget for the discovery rather than pretending the gap is not there.

7. Retest and re-issue

Re-testing the fixed findings and re-issuing the report with a verification statement is typically one to two days. It is the cheapest day in the engagement and the one most often cut. Certification bodies, enterprise procurement teams and regulators under DORA and PCI DSS all want evidence that findings were closed, not just that they were found.

Two worked scopes

The bands below use the published EU day-rate span of €640 to €1,800. The width of the resulting range is not sloppiness; it is the honest gap between a competent regional firm and a premium boutique doing comparable work.

Scope A: a consumer REST API

Twenty-two endpoints, two roles (user and support agent), a single tenant, one OAuth2 flow, a current OpenAPI document, staging with realistic data, retest included. There is nothing exotic here: the authorization matrix is 2 roles by roughly 8 object types, discovery is nearly free because the specification is current, and consumption testing can run on staging without a scheduling conversation.

Expect a 5 to 7 tester-day band, which lands between about €3,000 and €12,500 depending on the firm. That is consistent with both the EJN Labs 4-to-5-day band for the simplest scopes and the Securitum fixed-price floor of €3,500.

Scope B: a multi-tenant B2B platform

Around 140 REST operations plus a GraphQL gateway, five roles, genuine multi-tenancy, OAuth2 for the web client and mutual TLS for partner integrations, a partial specification, production verification required after staging, PCI DSS as the driver, retest included.

The endpoint count alone puts this in the 11-day base band. Multi-tenancy, five roles, two authentication schemes, a second API style, a stale specification, production checks and a compliance driver each add. A realistic band is 15 to 20 tester-days, or roughly €9,500 to €36,000. If a vendor quotes this scope at six days, they are quoting a REST scan with a GraphQL introspection query attached.

You can run either scope, or your own, through the scope estimator on the home page. It applies the same arithmetic and shows which OWASP categories the plan will be dominated by.

What a cheap quotation leaves out

A quotation that is half the price of its neighbours is usually not cheaper. It is smaller. These are the five things that disappear first, in the order they disappear.

• The authorization matrix. The slowest and most valuable part of the work. Without it you get injection and misconfiguration findings, which is a scan with a human cover letter.
• Undocumented endpoints. Testing only what the specification lists means the routes most likely to be broken, the forgotten ones, are also the untested ones.
• Business-flow abuse. API6 work requires understanding your product. It is the first thing dropped when the tester has not been given time to read anything.
• Evidence. A finding without the request and response that produced it cannot be reproduced, cannot be prioritized honestly and will be argued about for a month.
• The retest. Cut it and your report says what was broken in September, not what is broken now.

SECFORCE puts a floor on this in public: below about £500 per day, you are buying a scan rather than a test. That is a useful sanity check in both directions, because it also means a very high rate does not by itself buy more days.

How to write a request that gets comparable quotations

Most of the variance between quotations comes from vendors guessing differently about the same missing information. Supply it once, in writing, and the quotes converge.

• The operation count, and how you counted it. Say whether the number is paths or path-plus-verb, and include GraphQL fields and mutations separately.
• The role list, with a one-line description of what each role can do that the others cannot, and whether the system is multi-tenant.
• Every authentication scheme in scope, and who can supply working credentials for each.
• The API styles: REST, GraphQL, gRPC, WebSocket, webhooks, and which of them are in scope.
• The environment, its data realism, and whether production verification is required.
• The state of the specification, honestly. “Stale, last updated at v2, we are on v4” is far more useful than a link to a swagger file.
• The compliance driver, if there is one, and the clause you need the report to answer.
• Whether a retest and a re-issued statement are required, and by when.
• Ask every vendor to break out: tester-days, day rate, reporting allowance, retest allowance.

Red flags in a quotation

• A price arrives with no scoping call and no scoping questions. Nobody can size an authorization matrix from a domain name.
• The quotation is per endpoint. Endpoints are not the unit of work, and per-endpoint pricing rewards a vendor for ignoring your roles.
• No day count anywhere in the document.
• The methodology section names only tools. Tools are the cheap part.
• The retest is priced as a second full engagement.
• A sample report cannot be provided, not even redacted. Every serious firm has one.
• The report will be delivered as tool output with a cover page. Ask to see the finding template before you sign.

What the total actually buys

For a small API, the whole exercise is comparable to two weeks of one engineer’s salary. For a multi-tenant platform, it is a fortnight of two. Against that, the Dell partner-portal API gave up 49 million records to an attacker sending 5,000 requests per minute for three weeks, and the McHire object-level flaw exposed the data of more than 64 million applicants to anyone who could decrement an integer. Neither required a novel technique. Both would have shown up in the authorization pass that cheap quotations remove.