Latest API Security
As of August 2026, the governing references are:
- OWASP API Security Top 10 — 2023 edition (still the current API-specific list).
- OWASP Web Application Top 10 — 2025 edition (general web; adds Software Supply Chain Failures and Mishandling of Exceptional Conditions).
- OWASP Web Security Testing Guide (WSTG) — API Testing (
WSTG-APIT-*), covering BOLA, GraphQL, and other API-specific tests. - OWASP API Security Project — checklists and tooling guidance.
The 2023 API Top 10 at a glance
Section titled “The 2023 API Top 10 at a glance”| # | Risk | What it means |
|---|---|---|
| API1 | Broken Object Level Authorization (BOLA) | Change an ID → access someone else’s object. The #1 API risk. |
| API2 | Broken Authentication | Flawed tokens/sessions, credential stuffing, token leakage. |
| API3 | Broken Object Property Level Authorization (BOPLA) | Over-exposed fields (excessive data exposure) or setting fields you shouldn’t (mass assignment). |
| API4 | Unrestricted Resource Consumption | No rate limiting / caps → DoS or cost abuse. |
| API5 | Broken Function Level Authorization (BFLA) | User reaches admin-only functions. |
| API6 | Unrestricted Access to Sensitive Business Flows | Abusing flows at scale (scalping, bulk signup, spam) — a logic flaw. |
| API7 | Server-Side Request Forgery (SSRF) | Unvalidated user URL → internal network access. |
| API8 | Security Misconfiguration | Verbose errors, debug endpoints, default creds, missing headers. |
| API9 | Improper Inventory Management | Stale/undocumented/debug API versions exposed. |
| API10 | Unsafe Consumption of APIs | Blindly trusting data from third-party APIs. |
See the full reference for descriptions and testing hints.
Modern testing techniques
Section titled “Modern testing techniques”The 2025/2026 landscape has shifted from periodic manual pentests toward continuous, context-aware, automated API testing.
-
Continuous / shift-left testing — API security in CI/CD (GitHub Actions, GitLab, Jenkins); every merge re-tests every endpoint. Over 60% of API breaches tie to known but untested endpoints.
-
Context-aware, stateful attack simulation — tools replay multi-step, role-based flows (login → create → access-as-other-user) using live traffic instead of stateless single-request scans. This is the modern way to catch BOLA/BFLA and business-logic flaws that static scanners miss.
-
eBPF-based, agentless discovery — platforms like Levo.ai and Traceable.ai use kernel-level (eBPF) telemetry to auto-discover shadow APIs (internal, undocumented, deprecated) without agents or payload capture.
-
AI / LLM-driven fuzzing — LLMs generate context-aware, schema-valid fuzz payloads (and infer schemas from traffic), improving coverage over generic wordlists. Emerging but rapidly adopted.
-
GraphQL & gRPC coverage — dedicated tooling (clairvoyance, graphql-cop, InQL), since traditional WAFs/routers struggle with these protocols.
-
Runtime threat detection — behavioral anomaly detection on live API traffic (exfiltration, enumeration bursts, credential stuffing) complementing pre-production testing.
-
Shadow/rogue API inventory — continuous inventory management (API9) as a first-class control, not an afterthought.
How this maps to the workflow
Section titled “How this maps to the workflow”Each technique slots into the replication workflow:
| Technique | Workflow phase |
|---|---|
| eBPF / traffic capture | Phase 0 — capture the contract |
| Schema inference + spec analysis | Phase 1 — understand the endpoint |
| Context-aware fuzzing | Phase 4 — hammer the replica |
| Stateful authN/authZ replay | Phase 4 — matrix testing |
| Validated replay to production | Phase 5 — transfer validated payloads |