Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

OWASP API Security Testing Framework

Free#17 of 27 in API Security Testing Software

OWASP API Security Testing Framework: A focused self-hosted CLI for OWASP API Top 10 coverage and CI checks. Ranked #17 of 27 in API Security Testing Software by our editors (7.5/10); pricing: Open source; best for open-source OWASP API Top 10 testing.

7.5/10Editor score
Visit OWASP ASTF
OWASP API Security Testing Framework7.5 Visit OWASP ASTF

At a glance

  • Editor score
    7.5 / 10
  • Pricing
    Open source
  • Best for
    Open-source OWASP API Top 10 testing
  • Paid from
    Free
  • Authorization testing
    Yes
  • Founded
    2001
  • Facts checked
    20 Sep 2026
OWASP API Security Testing Framework screenshot

  • Where it wins

    • Tests all 10 OWASP API Security Top 10 categories
    • Supports GraphQL, gRPC, JWT, SSRF, injection, and rate-limit checks
    • Generates HTML, JSON, SARIF, and XML reports

  • Where it doesn't

    • Self-hosted deployment requires teams to manage the runtime
    • Business-logic flow testing is not included
    • OpenAPI/Swagger specification import is planned, not completed

Our verdict on OWASP API Security Testing Framework

OWASP API Security Testing Framework (ASTF) is an open-source command-line tool for automated API security testing. It is designed for developers, security testers, and teams adding API checks to CI/CD workflows. ASTF discovers API endpoints through OpenAPI/Swagger probing and common path patterns, then assesses risks across all 10 OWASP API Security Top 10 categories. Its coverage includes authentication, authorization, input validation, GraphQL, gRPC, and several focused vulnerability checks.

The framework’s strongest technical depth is in security test coverage. It can test cross-user authorization with two authenticated identities and supports bearer tokens, API keys, Basic authentication, mutual TLS, and custom headers. Checks include SQL and NoSQL injection, JWT, SSRF, rate limiting, and ReDoS. This gives teams a broad starting point for automated API assessment, while report generation in HTML, JSON, SARIF, and XML supports both review workflows and security tooling.

ASTF is self-hosted and integrates with GitHub Actions, making it a fit for teams comfortable managing command-line security tooling inside their own environments. The open-source model avoids a paid plan structure, but convenience depends on the team’s deployment and pipeline setup. ASTF is less suitable when testing depends on multi-step business logic flows or importing an OpenAPI/Swagger specification directly, since business-logic testing is not included and specification import is listed in the roadmap. Choose it for open-source OWASP API Top 10 coverage with varied authentication and protocol support; consider another tool for deeper workflow testing or a managed platform.

Your product? Our editors can test OWASP API Security Testing Framework in depth and publish a review, labelled as paid · from $149/mo →

OWASP API Security Testing Framework pricing

Plans Open sourceFree Free to use — no paid tier required for the core job.
See plans on owasp.org

OWASP API Security Testing Framework fact sheet

Free planNot verified
Paid fromFree
API discoveryYes
Authentication testingYes
Authorization testingYes
Input-validation testingYes
Business-logic testingNo
DeploymentSelf-hosted
API formatsOpenAPI/Swagger, REST, GraphQL, gRPC
DeploymentSelf-hosted
SupportCommunity, Docs
Built forSolo, Small business, Mid-market, Enterprise (editorial estimate)
Integrations1 integrations: GitHub Actions
PricingOpen source
Websiteowasp.org
Facts checked20 Sep 2026

OWASP API Security Testing Framework integrations

OWASP API Security Testing Framework lists 1 integrations on its own site.

  • GitHub Actions

Alternatives to OWASP API Security Testing Framework

See all OWASP API Security Testing Framework alternatives →

Used OWASP API Security Testing Framework? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used OWASP API Security Testing Framework for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

0 characters · at least 80, up to 3,000

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Featured on iTechGuides — OWASP API Security Testing Framework 7.5/10

OWASP API Security Testing Framework is listed in our API Security Testing Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/owasp-api-security-testing-framework/"><img src="https://www.itechguides.com/best/badge/owasp-api-security-testing-framework.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update