OWASP API Security Top 10 Explained | Vooki Pro

The OWASP API Security Top 10, explained

OWASP API Security Top 10 Explained

The OWASP API Security Top 10 lists the most critical risks specific to APIs. It differs from the classic OWASP Top 10 because APIs fail in their own ways, especially around authorization and data exposure.

How it works

The list covers broken object-level authorization (BOLA), broken authentication, broken object property-level authorization (including mass assignment and excessive data exposure), unrestricted resource consumption, broken function-level authorization (BFLA), unrestricted access to sensitive business flows, server-side request forgery, security misconfiguration, improper inventory management, and unsafe consumption of third-party APIs.

Why it matters

  • APIs expose data and functions directly, without a user interface in the way.
  • Authorization flaws in APIs are the most common cause of API data breaches.
  • Many organisations do not have a full inventory of their APIs.

Best practices

  • Enforce authorization on every object and function, server-side.
  • Return only the fields each client needs.
  • Apply rate limits and size limits.
  • Keep an inventory of APIs and retire old versions.
  • Treat data from third-party APIs as untrusted.

How Vooki Pro helps

  • Includes API security checks aligned to the OWASP API Security Top 10: BOLA, BOPLA, BFLA, mass assignment, resource consumption, SSRF, misconfiguration, inventory, versioning and unsafe consumption.
  • Tests GraphQL APIs for introspection exposure and denial of service.
  • Also runs the full set of web checks (injection, authentication, headers and more) against your API.
  • Maps findings to compliance frameworks in its reports.

Frequently asked questions

What is the number one API security risk?

Broken object-level authorization (BOLA): accessing other users' objects by changing an ID.

How is the API Top 10 different from the OWASP Top 10?

It focuses on API-specific failures such as authorization at object and property level, resource consumption and API inventory.

Try Vooki Pro free for 7 days

Test your APIs against the OWASP API Security Top 10. The trial unlocks every feature for 7 days, and scanning runs on your own machine.

Get Vooki Pro →  ·  REST API scanning with Vooki Pro

Related: How to security-test a REST API from OpenAPI or Postman · Shadow APIs and API inventory: find what you forgot