The OWASP API Security Top 10 lists the most common and serious risks specific to APIs. The 2023 edition remains current; each page explains one risk and links the guides on this site that address it.
| Risk | Summary | Guides here |
|---|---|---|
| API1:2023 Broken Object Level Authorization | Endpoints accept object identifiers but do not confirm that the caller may perform the requested action on that particular object. | 5 |
| API2:2023 Broken Authentication | Flaws in authentication flows, recovery or token handling let attackers compromise credentials or tokens and act as other users or services. | 14 |
| API3:2023 Broken Object Property Level Authorization | Callers can read sensitive properties of an object or change properties they should not, combining excessive data exposure and mass assignment. | 3 |
| API4:2023 Unrestricted Resource Consumption | Missing limits on time, memory, upload size, batch operations, page sizes or paid third-party usage allow denial of service or runaway cost. | 8 |
| API5:2023 Broken Function Level Authorization | Callers can invoke functions beyond their role, such as administrative endpoints or privileged methods, because function-level checks are missing or inconsistent. | 3 |
| API6:2023 Unrestricted Access to Sensitive Business Flows | Business flows such as purchasing, posting or reserving are exposed without protection against automated, excessive use that harms the business. | 2 |
| API7:2023 Server Side Request Forgery | The API fetches a resource from a caller-supplied URL without adequate validation, so attackers can reach unintended or internal destinations. | 1 |
| API8:2023 Security Misconfiguration | Weak hardening across the API stack: missing patches, unnecessary features, inconsistent request processing along the server chain, missing TLS, cache or CORS policy, and verbose errors. | 8 |
| API9:2023 Improper Inventory Management | Hosts, versions and sensitive data flows are undocumented or never retired, leaving old, debug or shadow APIs exposed. | 1 |
| API10:2023 Unsafe Consumption of APIs | Data and behavior from third-party APIs are trusted too readily: weak validation, blindly followed redirects, and missing timeouts or resource limits. | 4 |
Entries from OWASP Top 10 API Security Risks – 2023. “Guides here” counts the guides whose main subject is the entry or that cover it in a dedicated section.