The OWASP API Security Top 10 is a practical list of common, critical threats specific to application programming interfaces. It provides a mental model for recognizing API risks beyond traditional web security. section 4.0
The risks group into several recurring failure modes:
- Weak authentication and authorization let attackers access other users’ objects, restricted operations, or administrative functions. section 4.11
- Poor input and data controls expose hidden properties or allow mass assignment and excessive data exposure. section 4.11
- Abused business flows, unrestricted resource consumption, server-side request forgery, misconfiguration, and unmanaged API versions expand the attack surface. section 4.11 section 5.0
A practical API failure
If user A changes an object identifier in a request and receives user B’s private data, the API has broken object-level authorization. Validate every object request against the caller’s permissions, constrain input, and use strict data models. section 4.11
