API Security
OWASP Top 10 for API Security
A focused OWASP Top 10 for API-first systems, covering authorization, authentication, resource abuse, inventory hygiene, and third-party API trust boundaries.
Select an Official Release Year
Pick a year to view release rankings, or switch to All Time for the cross-release top 10.
| Rank | Title | Summary | Details |
|---|---|---|---|
| #1 | Broken Object Level Authorization | APIs expose object identifiers and allow unauthorized access when object-level authorization checks are missing. | View Details |
| #2 | Broken User Authentication | Weak token/session handling allows attackers to impersonate users or hijack API sessions. | View Details |
| #3 | Excessive Data Exposure | APIs return more fields than needed, leaking sensitive data through overbroad responses. | View Details |
| #4 | Lack of Resources and Rate Limiting | Missing quotas and limits enables denial of service, brute force, and cost-amplification abuse. | View Details |
| #5 | Broken Function Level Authorization | Privileged API functions are reachable without proper role or policy checks. | View Details |
| #6 | Mass Assignment | Attackers inject unexpected object properties when APIs bind request bodies too broadly. | View Details |
| #7 | Security Misconfiguration | Unsafe defaults, exposed debug features, and weak hardening create avoidable attack paths. | View Details |
| #8 | Injection | Untrusted API input is interpreted as commands or queries, enabling injection attacks. | View Details |
| #9 | Improper Assets Management | Undocumented, stale, or shadow APIs increase attack surface and weaken governance. | View Details |
| #10 | Insufficient Logging and Monitoring | Security incidents remain undetected when API events are not logged and alerted properly. | View Details |