API Security · 2023 edition
A focused OWASP Top 10 for API-first systems, covering authorization, authentication, resource abuse, inventory hygiene, and third-party API trust boundaries.
Official OWASP list| Rank | Risk | Summary | Details |
|---|---|---|---|
| 01 | Broken Object Level Authorization | Endpoints that expose object identifiers can let attackers access records they do not own when object-level authorization checks are missing or inconsistent. | Details |
| 02 | Broken Authentication | Weak token handling, flawed login flows, or insecure session logic let attackers impersonate legitimate users. | Details |
| 03 | Broken Object Property Level Authorization | APIs can expose or allow updates to object properties that callers should not be allowed to read or modify. | Details |
| 04 | Unrestricted Resource Consumption | Missing limits on compute, storage, bandwidth, or paid downstream actions can turn APIs into denial-of-service or cost-amplification targets. | Details |
| 05 | Broken Function Level Authorization | Administrative or privileged functions become reachable when route- or action-level authorization is not enforced correctly. | Details |
| 06 | Unrestricted Access to Sensitive Business Flows | Business-critical flows can be automated and abused when APIs do not distinguish legitimate usage from harmful high-volume behavior. | Details |
| 07 | Server Side Request Forgery | User-controlled remote fetches can be abused to coerce backend systems into making requests to internal or unexpected destinations. | Details |
| 08 | Security Misconfiguration | Weak defaults, exposed debug features, missing hardening, or inconsistent deployment settings create avoidable attack paths. | Details |
| 09 | Improper Inventory Management | Undocumented endpoints, stale versions, and forgotten environments expand the attack surface and weaken governance. | Details |
| 10 | Unsafe Consumption of APIs | Trusting third-party APIs too much can import insecure data, behavior, or dependencies directly into your own system. | Details |
