OWASP API Top 10
The OWASP API Security Top 10 (2023) is the current API-specific risk list. Use it to categorize every finding.
The list
Section titled “The list”API1 — Broken Object Level Authorization (BOLA)
Section titled “API1 — Broken Object Level Authorization (BOLA)”Missing per-object authorization. Change an object ID in a request and you can read or modify someone else’s resource.
Test: iterate IDs/UIDs across two accounts; a 200 where you expect 403/404 is the tell.
API2 — Broken Authentication
Section titled “API2 — Broken Authentication”Flawed token/session handling, weak password reset, credential stuffing, token leakage.
Test: token expiry/reuse, JWT algorithm confusion, missing rate limits on login.
API3 — Broken Object Property Level Authorization (BOPLA)
Section titled “API3 — Broken Object Property Level Authorization (BOPLA)”Combines Excessive Data Exposure (fields returned that a user shouldn’t see) with Mass Assignment (setting fields a user shouldn’t control, e.g. role: "admin").
Test: strip/add JSON fields; watch for over-broad responses or accepted privileged fields.
API4 — Unrestricted Resource Consumption
Section titled “API4 — Unrestricted Resource Consumption”No rate limiting or resource caps → DoS or cost abuse (email/SMS bombs, expensive queries).
Test: concurrency blasts; check for 429 and X-RateLimit-* headers.
API5 — Broken Function Level Authorization (BFLA)
Section titled “API5 — Broken Function Level Authorization (BFLA)”A user reaches admin-only functions (role confusion, missing checks on functions).
Test: replay admin endpoints as a low-privilege user across the route × method × role matrix.
API6 — Unrestricted Access to Sensitive Business Flows
Section titled “API6 — Unrestricted Access to Sensitive Business Flows”Abusing business flows at scale — scalping, bulk signup, comment spam. A logic flaw, not an implementation bug.
Test: automate the flow; check for compensating controls (captchas, per-user limits).
API7 — Server-Side Request Forgery (SSRF)
Section titled “API7 — Server-Side Request Forgery (SSRF)”Unvalidated user-supplied URL → the server fetches internal resources.
Test: submit internal/cloud-metadata URLs (169.254.169.254) and watch for reflected fetches.
API8 — Security Misconfiguration
Section titled “API8 — Security Misconfiguration”Verbose errors, open debug endpoints, default credentials, missing CORS/security headers.
Test: trigger errors for stack traces; probe /debug, /actuator, /swagger-ui.
API9 — Improper Inventory Management
Section titled “API9 — Improper Inventory Management”Stale, undocumented, or debug API versions left exposed.
Test: enumerate /v1, /v2, /beta, /internal prefixes; diff documented vs live surface.
API10 — Unsafe Consumption of APIs
Section titled “API10 — Unsafe Consumption of APIs”Blindly trusting data from third-party APIs that the app then uses unsafely.
Test: follow data flows into third-party calls; look for unvalidated ingestion.
Quick reference
Section titled “Quick reference”| # | Risk | Typical tell |
|---|---|---|
| API1 | BOLA | 200 on another user’s object ID |
| API2 | Broken Authentication | Token replay / no rate limit on login |
| API3 | BOPLA | Over-exposed fields, accepted role field |
| API4 | Resource Consumption | No 429 under load |
| API5 | BFLA | Admin endpoint works as low-priv user |
| API6 | Sensitive Flows | Bulk/scalper automation succeeds |
| API7 | SSRF | Server fetches internal URL |
| API8 | Misconfiguration | Stack traces, debug endpoints |
| API9 | Inventory | Stale/debug API versions live |
| API10 | Unsafe Consumption | Third-party data used unsafely |