The OWASP API Security Top 10 (2023) — API Security in Depth

APIs expose objects, properties and functions directly, so the dominant risks are authorization failures rather than injection. The 2023 OWASP API Security Top 10 is the shared vocabulary for reviews, pentests and threat models. Three of the ten are authorization (objects, properties, functions); others cover authentication, resource consumption, abusable business flows, SSRF, misconfiguration, inventory and trusting third-party APIs.

OWASP API Security Top 10 — 2023

ID	Risk	One-line example	Primary defense
API1	Broken Object Level Authorization (BOLA)	GET /orders/1002 returns someone else's order	Ownership check on every object access
API2	Broken Authentication	No lockout, weak token validation	Standard flows, strict token validation, rate limits
API3	Broken Object Property Level Authorization	User sets is_admin via PATCH; API leaks internal fields	Explicit input/output schemas per role
API4	Unrestricted Resource Consumption	page_size=1000000, huge uploads, costly SMS	Limits, quotas, timeouts, spending caps
API5	Broken Function Level Authorization	Regular user calls DELETE /admin/users/7	Deny-by-default role/permission checks per route
API6	Unrestricted Access to Sensitive Business Flows	Bots buy all concert tickets	Flow-level abuse controls, device/fraud signals
API7	Server-Side Request Forgery	Webhook URL → http://169.254.169.254/	Egress allowlists, IP checks, no redirects
API8	Security Misconfiguration	Verbose errors, permissive CORS, missing TLS	Hardened defaults, config scanning
API9	Improper Inventory Management	Forgotten /v1 or staging API with real data	API inventory, retirement, environment separation
API10	Unsafe Consumption of APIs	Trusting partner API responses blindly	Validate, time out and sandbox third-party data

Common pitfalls

Equating API security with 'we use JWT'.
Only scanning for injection.
Treating the list as a checklist rather than a threat-model input.

Key points

Authorization dominates API risk
Use the Top 10 as shared vocabulary
Each risk maps to concrete controls and tests

Further reading: OWASP API Security Top 10 2023

Practice questions

Which three OWASP API Top 10 (2023) risks are about authorization?

Answer

API1 Broken Object Level Authorization, API3 Broken Object Property Level Authorization and API5 Broken Function Level Authorization.

What does API6 'Unrestricted Access to Sensitive Business Flows' mean?

Answer

A legitimate flow (buying, signing up, posting) can be automated at scale to harm the business — e.g. scalping, spam or referral fraud — even when each request is individually authorized.