REST and GraphQL APIs, integrations and event-driven backends that are documented, rate-limited and tested for the authorisation flaws in the OWASP API Top 10. The backend behind our web and mobile apps — and yours.
Every product we build runs on an API, and most of the critical findings in our penetration tests live in APIs too: broken object-level authorisation, mass assignment, unbounded queries, leaky error messages. Evosec's API development practice exists to build backends that don't have those problems.
We build on Laravel and Node.js, document with OpenAPI, ship with contract tests, and integrate with the third-party systems that make products real: Stripe, Adyen, Twilio, Onfido, Salesforce, SAP, and the French and Tunisian banking gateways.
Versioned, paginated, documented with OpenAPI / GraphQL schema, backed by contract tests.
Payments, KYC/AML, e-signature, ERP/CRM, shipping, messaging — with retries, idempotency and webhooks done right.
Token auth with refresh rotation, push, offline sync, media handling and rate limiting for iOS/Android clients.
Queues, workers, schedulers and event streams (Redis, SQS, Kafka) for workloads that shouldn't block a request.
PostgreSQL schema design, indexing, caching strategies and observability so you know why something is slow.
OWASP API Top 10 testing before launch, auth/authz review, secrets management, WAF and abuse protection.
REST for most public APIs and integrations; GraphQL when many client types need flexible queries against a rich data graph. We've shipped both and will recommend based on your consumers.
Yes — SAP, Sage, Odoo, Dynamics and bespoke systems via APIs, files or database sync, with reconciliation and monitoring.
Automated scanning in CI plus a manual test against the OWASP API Security Top 10 by our penetration testers before every major release.
Yes — most of our API projects ship alongside a React Native or Flutter app built by the same team.