API Security
OWASP Top 10 for API Security
A focused OWASP Top 10 for API-first systems, covering authorization, authentication, resource abuse, inventory hygiene, and third-party API trust boundaries.
Select an Official Release Year
Pick a year to view release rankings, or switch to All Time for the cross-release top 10.
| Rank | Title | Summary | Details |
|---|---|---|---|
| #1 | Broken Object Level Authorization | Endpoints that expose object identifiers can let attackers access records they do not own when object-level authorization checks are missing or inconsistent. | View Details |
| #2 | Broken Authentication | Weak token handling, flawed login flows, or insecure session logic let attackers impersonate legitimate users. | View Details |
| #3 | Broken Object Property Level Authorization | APIs can expose or allow updates to object properties that callers should not be allowed to read or modify. | View Details |
| #4 | Unrestricted Resource Consumption | Missing limits on compute, storage, bandwidth, or paid downstream actions can turn APIs into denial-of-service or cost-amplification targets. | View Details |
| #5 | Broken Function Level Authorization | Administrative or privileged functions become reachable when route- or action-level authorization is not enforced correctly. | View Details |
| #6 | Unrestricted Access to Sensitive Business Flows | Business-critical flows can be automated and abused when APIs do not distinguish legitimate usage from harmful high-volume behavior. | View Details |
| #7 | Server Side Request Forgery | User-controlled remote fetches can be abused to coerce backend systems into making requests to internal or unexpected destinations. | View Details |
| #8 | Security Misconfiguration | Weak defaults, exposed debug features, missing hardening, or inconsistent deployment settings create avoidable attack paths. | View Details |
| #9 | Improper Inventory Management | Undocumented endpoints, stale versions, and forgotten environments expand the attack surface and weaken governance. | View Details |
| #10 | Unsafe Consumption of APIs | Trusting third-party APIs too much can import insecure data, behavior, or dependencies directly into your own system. | View Details |