Engineering reference

API Security Guides

Comprehensive guides to help developers and security engineers understand, implement, and maintain secure APIs.

API Authentication

Learn how to secure your APIs with modern authentication methods like JWT, OAuth 2.0, and API Keys.

API Authorization

Understand the different levels of API authorization and how to implement them effectively.

API Trust Boundaries

Discover the hidden risks of assuming data from trusted sources is inherently safe.

API Security Tools

Explore the different layers of API security tools and what each can and cannot protect against.

API Security Checklist

A practical checklist covering authentication, rate limiting, object-level authorization, SSRF, schema validation, and logging.

OWASP API Top 10 Categories

These categories exist to highlight the most common and highest-impact API security risks seen in real systems. Use this list as a roadmap to work through one consolidated guide without repeating the same framework across separate pages.

API1:2023 - Broken Object Level Authorization (BOLA)

APIs expose object identifiers, and missing object-level access checks let attackers access other users' data.

API2:2023 - Broken Authentication

Weak auth flows and token handling allow account takeover, impersonation, and unauthorized API usage.

API3:2023 - Broken Object Property Level Authorization

Lack of field-level controls can expose sensitive properties or allow unauthorized updates through mass assignment.

API4:2023 - Unrestricted Resource Consumption

Missing limits on requests, payloads, or expensive operations can cause abuse, outages, and denial of service.

API5:2023 - Broken Function Level Authorization

Inconsistent role and permission checks let users invoke admin or privileged API functions they should not access.

API6:2023 - Unrestricted Access to Sensitive Business Flows

Critical business actions without anti-automation controls can be abused at scale for fraud and business logic attacks.

API7:2023 - Server Side Request Forgery (SSRF)

APIs that fetch remote resources can be manipulated to access internal services and metadata endpoints.

API8:2023 - Security Misconfiguration

Insecure defaults, verbose errors, and poor hardening create easy attack paths and accidental data exposure.

API9:2023 - Improper Inventory Management

Unknown, old, or shadow API versions remain exposed and unprotected when inventory and lifecycle controls are weak.

API10:2023 - Unsafe Consumption of APIs

Trusting third-party APIs without validation, segmentation, or resilience controls introduces supply-chain risk.