AppCheck
UK vulnerability scanner with a dedicated API module for REST, SOAP and GraphQL, including request signing and OAuth sessions
Quick Overview
| Company | AppCheck Ltd |
|---|---|
| Category | API Security Platforms |
| Headquarters | Batley, West Yorkshire, United Kingdom |
| Founded | Not stated |
| EU Presence | Yes - United Kingdom |
| Data Location | Not stated on the pages checked |
| Open Source | No |
| GDPR Compliant | Yes |
| Self-Hosting | Scans internal, external, cloud and self-hosted assets |
| Main Features | API scanning (REST, SOAP, GraphQL), fixture generation from Swagger and GraphQL, HMAC and AWS v4 request signing, TOTP and OAuth, IDOR checks, web and infrastructure scanning |
| Pricing | Pricing not published; licences include unlimited users |
| Best For | Teams that need one scanner for APIs, web apps and infrastructure with complex authentication |
| Replaces | Traceable testing features, Salt Security posture checks |
Detailed Review
AppCheck grew out of an internal penetration testing tool and its API scanner follows the same logic: build a model of the API from its schema, then craft tests for each method instead of replaying a signature list.
AppCheck Ltd is registered in England and Wales (company number 06888174) and names itself as UK data controller in its privacy policy, with a Batley address.
Hard authentication cases
Many APIs refuse unsigned or replayed requests, and scanners stall there. AppCheck documents HMAC signing, AWS v4 signing, chainable rules for custom signatures, and sessions kept alive with TOTP and OAuth.
That matters for finance and cloud-native services where the signature is part of the contract.
Schema-fed testing
The scanner understands REST with JSON, SOAP by WSDL and GraphQL, and generates fixture data from Swagger and GraphQL definitions so requests carry plausible values. It also lists authorization and permissions flaws such as IDOR among its checks, and can scan a backend API and its single-page frontend in one run.
More than APIs
The same licence covers web applications, infrastructure, CMS and asset discovery, and all licences are described as having unlimited users. That suits a team that wants one vendor rather than a specialist API product.
Limitations to Consider
AppCheck is a scanner: it finds vulnerabilities but does not discover traffic-level attacks or block anything at runtime. No prices are published, and the page does not describe API inventory from live traffic. For specification-driven audits compare 42Crunch; for attack-style logic testing see Equixly.
Who Should Use AppCheck
Security teams in organisations with web, infrastructure and API estates that want a single scanning contract and strong handling of signed or token-based APIs.
Pros and Cons
Pros
- Handles request signing and OAuth or TOTP sessions
- Supports REST, SOAP and GraphQL
- Generates test data from Swagger and GraphQL schemas
- Same licence covers web and infrastructure scanning
- UK company registered at Companies House number 06888174
Cons
- No runtime protection
- No published prices
- No traffic-based API discovery described
- Hosting region not stated
Alternatives to AppCheck
Other European api security platforms worth comparing before you decide:
42Crunch
United Kingdom · Contract-driven API audit, scan and runtime protection from OpenAPI files
Equixly
Italy · Agentic AI penetration testing aimed at API business logic
Escape
France · Business-logic DAST for REST and GraphQL APIs from Paris
Aikido Security
Belgium · Developer security suite with an API scanner and shadow API discovery
See all European api security platforms or compare them directly against Traceable testing features on our alternatives page.
Frequently Asked Questions
Yes, its API page lists REST with JSON, WSDL-based SOAP and GraphQL.
The vendor documents HMAC and AWS v4 request signing, plus chainable rules for custom signatures.
No. The same platform scans web applications, infrastructure, CMS and single-page apps.