API Security Top 10
The API Security Top 10 is an OWASP publication identifying prevalent and critical security risks specific to application programming interfaces.
Secure APIs
The OWASP Top 10 API Security Risks is a published list of the most critical and prevalent security risks specific to application programming interfaces.
- How it is used
- Uses a risk taxonomy to recognize, explain, test, and mitigate API-specific security failures.
- How deep it goes
- Explains attack patterns through coding examples and practical mitigations, covering access control, configuration, and management risks.
- Examples
- Uses BOLA, non-admin access, scalper bots, hidden properties, old API versions, internal endpoints, and vulnerable Python servers.
- What you can do after
- Diagnose API vulnerability patterns and apply access controls, strict models, standard authentication, threat detection, and safer configuration.
Automating API Delivery
The OWASP API Security Top 10 is an industry awareness document describing and ranking prevalent security risks specific to APIs.
- How it is used
- Frames prevalent API threats for design-time linting, CI/CD security checks, runtime validation, and development-life-cycle controls.
- How deep it goes
- Lists the 2023 risks and five lint-detectable examples, but defers detailed vulnerability mitigation to OWASP resources.
- Examples
- Uses five 2023 risks—authorization, authentication, resource consumption, and misconfiguration—as linting targets.
- What you can do after
- Apply via API linting and gateway validation to catch selected security issues before deployment and reduce backend-service exposure.
Read how Automating API Delivery explains API Security Top 10 →
Related concepts
- API securityuses · API security is the protection of application programming interfaces, their functionality, and exposed data from unauthorized access, misuse, alteration, and disruption.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.