OWASP API Security Top 10 (2023) Explained
The OWASP API Security Top 10 exists because APIs fail differently from traditional web pages. The 2023 edition is the current version, and it is a useful checklist for any team shipping an API.
API1: Broken Object Level Authorization (BOLA)
The API does not check that the caller may access the specific object requested. Changing an ID returns another user's data.
Prevent: check ownership or tenancy for every object on every request. See our BOLA guide.
API2: Broken Authentication
Weak authentication mechanisms: missing rate limits, weak tokens, accepting unsigned JWTs, or credentials in URLs.
Prevent: use standard, well-tested authentication, validate tokens fully and rate limit authentication endpoints.
API3: Broken Object Property Level Authorization (BOPLA)
Combines excessive data exposure and mass assignment. Users can read properties they should not see, or write properties they should not change.
Prevent: return only the fields each role needs, and allowlist writable fields explicitly.
API4: Unrestricted Resource Consumption
No limits on request rate, payload size, pagination or expensive operations, leading to denial of service or large bills, such as SMS or AI API costs.
Prevent: rate limits, quotas, maximum page sizes, timeouts and spending caps on paid integrations.
API5: Broken Function Level Authorization (BFLA)
Normal users can call administrative or privileged functions, often by guessing endpoints like /admin/users or changing the HTTP method.
Prevent: deny by default, and enforce role checks for every function, not just in the UI.
API6: Unrestricted Access to Sensitive Business Flows
Automated abuse of legitimate flows, such as buying all limited stock, mass-creating accounts, or scraping, without exploiting a bug as such.
Prevent: identify sensitive flows and add protections like device fingerprinting, CAPTCHAs, rate limits per account and anomaly detection.
API7: Server-Side Request Forgery (SSRF)
The API fetches a user-supplied URL without validation, reaching internal services or cloud metadata.
Prevent: allowlist destinations, validate resolved IPs and restrict egress. See our SSRF guide.
API8: Security Misconfiguration
Missing hardening: permissive CORS, verbose errors, unnecessary HTTP methods, missing TLS or default settings.
Prevent: a hardened, automated configuration baseline across environments.
API9: Improper Inventory Management
Unknown, undocumented or deprecated API versions and hosts remain live, often with weaker security.
Prevent: maintain an API inventory, retire old versions, and monitor for shadow APIs.
API10: Unsafe Consumption of APIs
Trusting data from third-party APIs too much, such as not validating responses, following redirects blindly or using integrations over unencrypted channels.
Prevent: treat third-party responses as untrusted input, validate and sanitise them, and set timeouts.
Summary
| ID | Risk | Most effective control |
|---|---|---|
| API1 | BOLA | Per-object ownership checks |
| API2 | Broken authentication | Standard auth, token validation |
| API3 | BOPLA | Field allowlists for read and write |
| API4 | Resource consumption | Rate limits and quotas |
| API5 | BFLA | Deny-by-default role checks |
| API6 | Sensitive business flows | Abuse detection |
| API7 | SSRF | Destination allowlists |
| API8 | Misconfiguration | Hardened baseline |
| API9 | Inventory | API catalogue and retirement |
| API10 | Unsafe consumption | Validate third-party data |
SecurityInfinity's API agent tests against the OWASP API Security Top 10 with multiple identities, verifies every finding and gives a fix. Start free.
Frequently asked questions
How is the API Top 10 different from the web Top 10?
It focuses on authorisation at object, property and function level, inventory and resource consumption, which are more prominent risks for APIs.
Is there a newer version than 2023?
At the time of writing, 2023 is the current edition of the OWASP API Security Top 10.
Which API risk should we address first?
BOLA. It is the most common and often the most damaging, and it requires authenticated testing to find.