Tool profile
APIsec: cost, fit and limits
APIsec is an API security testing platform made by APIsec Inc. of San Francisco that runs automated attack simulations against REST and other APIs, including business-logic tests such as BOLA and role checks, for engineering and security teams.
What to know first
APIsec sells by the number of endpoints, in blocks of 100, where an endpoint is a method and path pair such as GET /user. Its pricing page lists a free plan, two paid tiers and a custom bug bounty tier. The AI label on the page covers use cases without describing models. Buyers should count endpoints from an OpenAPI file first, since that number sets the bill.
APIsec at a glance
| Maker | APIsec Inc., United States |
|---|---|
| Free plan | Yes |
| Entry price | $690 per month per 100 endpoints (Standard) |
| API access | No |
| Category | Best AI API Security Software in 2026, rank 1 of 10 |
| Website | apisec.ai |
Who APIsec is best for
Teams with a documented API
Pricing per 100 endpoints rewards a clean inventory, so a team that knows its method and path count can estimate the yearly cost before talking to anyone.
Developers testing before release
The free plan offers public API testing, basic test simulations and dashboard access with no credit card, which allows a first run on a staging API.
Companies with private APIs
Every plan can install a hosted agent so private APIs can be tested, and an on-premises deployment is available on custom pricing.
APIsec plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Free | $0 forever | Public API testing, basic test simulations, community support and dashboard access. No credit card is required, and specific limits are not listed. |
| Standard | $690 per month per 100 endpoints, or $8,275 per year | Continuous automated validation, business-logic attacks such as BOLA and RBAC, continuous API testing, team collaboration and dedicated support. |
| Pro | $2,750 per month per 100 endpoints, or $33,075 per year | Full CI/CD and ticketing integrations, custom attack simulations, advanced reporting with SLAs, white-glove onboarding and premium support. |
| Bug Bounty | Custom pricing | Certified expert reports, manual deep dives, private and public API testing, authentication support and periodic assurance. |
Checked November 2026.
What APIsec does
- Business-logic attacks
- Standard adds tests for broken object level authorization and role-based access, which are the flaws that signature scanners tend to miss because every request looks valid on its own.
- Continuous validation
- Tests run on a schedule instead of once per audit, so a new endpoint or a changed permission is checked again after each release rather than at the next yearly review.
- Hosted agent for private APIs
- A hosted agent installs inside a network to reach APIs that are not public. The page lists it on every plan, which is unusual for a free entry tier.
- AI-labeled use cases
- The page calls APIsec an AI-based AppSec platform and lists AI DAST, AI-BOM and API-BOM, and AI agents at runtime, without explaining how each works.
- Open source Surface tool
- A discovery tool called apisec Surface is open source on GitHub, so a team can look at part of the code before buying. It is a separate tool from the paid platform.
How APIsec handles your data
The privacy policy names APIsec Inc. at One Sansome, Suite 3500, San Francisco, and describes APIsec as processor of Service Data, with the customer as controller. Customer data and credentials are kept up to 365 days after account termination unless deletion is requested sooner. The policy says aggregated and anonymized data may be used to improve services and does not mention AI model training directly. It names no hosting provider, links to a subprocessor list and states no certification.
Where APIsec falls short in practice
- Free plan limits are not listed. The page describes what the free plan includes but gives no endpoint, scan or frequency cap. A team cannot tell how far a trial scales before a paid tier is required.
- Per-100-endpoint arithmetic. A company with 1,200 endpoints needs twelve blocks, which at Standard monthly pricing is about $8,280 a month. Large inventories reach quote territory quickly, so negotiate volume terms.
- No certification on the page. The pricing page names no SOC 2 or ISO status and does not print a headquarters beyond the policy address. Procurement teams will need to ask for reports directly.
Works with
Alternatives to APIsec
APIsec: common questions
What counts as an endpoint in APIsec pricing?
The pricing page defines an endpoint as a method and path combination, such as GET /user. Pricing is sold in blocks of 100 endpoints. A file with GET and POST on the same path therefore counts twice, so export your OpenAPI file and count before requesting a quote.
Does the APIsec free plan test private APIs?
The free plan is described as public API testing. The page says every plan can install a hosted agent to test private APIs, which may include Free, but it does not state limits. Confirm in a trial whether private testing works without a paid tier.
How long does APIsec keep my data after I cancel?
The privacy policy states that customer data and credentials are kept up to 365 days after account termination, unless you request earlier deletion. If you leave, send the deletion request in writing and ask for confirmation, since the default window is a full year.
Can APIsec run on premises?
Yes, on custom pricing. The pricing page lists on-premises deployment among its options, while all plans can install a hosted agent for private APIs. Ask which features differ in an on-premises install, since the page does not compare them. Ask which features differ.
Is APIsec open source?
Only in part. The page says the apisec Surface tool is open source and hosted on GitHub. The testing platform itself is a commercial product with the plans listed. Reading the open source tool helps judge code quality, but it does not show how the paid tests work.