OWASP API Top 10 Reference
Reference for the OWASP API Security Top 10 risks specific to API endpoints.
API-Specific Risks
The OWASP API Top 10 (2023) addresses risks unique to APIs. API1 Broken Object Level Authorization (BOLA/IDOR) is the top API risk. API2 Broken Authentication covers weak token validation. API3 Broken Object Property Level Authorization covers mass assignment and excessive data exposure. API4 Unrestricted Resource Consumption covers rate limiting and DoS. API5 Broken Function Level Authorization covers privilege escalation via endpoints.
- API1 BOLA
- Object-level authz
- API3
- Property-level authz
- API4
- Resource limits
IDORmass assignmentrate limitingAPI Security Patterns
APIs need authorization checks on every object access, not just endpoint access. Rate limiting per-client prevents abuse and DoS. Input validation and schema enforcement prevent injection and mass assignment. Token-based auth with short expiry and refresh limits reduces exposure. API gateways centralize rate limiting, auth, and logging. Contract testing ensures clients and servers agree on schemas. Monitoring detects anomalous access patterns.
- object authz
- Per-object checks
- rate limit
- Per-client limits
- gateway
- Centralized controls
not just endpointprevent DoSauth, logging