CREST Certified API Pen Test

I need a CREST-certified penetration tester to carry out a focused assessment of our RESTful API backend. I will supply normal-user credentials so you can work in a grey-box context and exercise the endpoints exactly as a regular customer would.

Scope and priorities
The test must dig deeply into access-control boundaries and data-exposure issues, scrutinise how we handle logins, tokens and session lifecycles, and probe every input for injection or parsing weaknesses. Automated reconnaissance is fine, but the core value I am after is manual, creative testing that maps our business logic and uncovers real-world exploit chains.

Required deliverables
• Technical report that lists every finding with reproducible evidence (Burp Suite request/response, PoC scripts, screenshots) and practical remediation guidance
• Executive summary in plain language for senior, non-technical stakeholders
• Retest section that confirms fixes once remediation is in place

The report must be structured, concise and ready for internal audit. Please note: only CREST-certified providers will be considered, and I will need the certificate reference before work begins.