Secure enterprise APIs by checking authorization at the object, property, and function level; protecting every communication path with TLS; controlling resource use and harmful automation; hardening and reviewing the API stack; keeping an accurate inventory of hosts and versions; and treating third-party API responses as untrusted input. The OWASP API Security Top 10 (2023) is a useful checklist for these risks, not a substitute for assessing your organization’s own systems and threat model.
Use the OWASP API Security Top 10 as a risk checklist
The 2023 edition identifies ten API-specific risk categories. Use them to structure reviews of your endpoints, integrations, and deployment practices:
As an Amazon Associate I earn from qualifying purchases.
- API1: Broken Object Level Authorization — a caller can access an object they are not entitled to use.
- API2: Broken Authentication — weaknesses in establishing or validating a caller’s identity.
- API3: Broken Object Property Level Authorization — a caller can read or change properties they should not access. The 2023 category brings together concerns previously described as excessive data exposure and mass assignment.
- API4: Unrestricted Resource Consumption — requests can consume excessive network, compute, memory, storage, or paid downstream resources.
- API5: Broken Function Level Authorization — a caller can use functions, such as administrative operations, beyond their permissions.
- API6: Unrestricted Access to Sensitive Business Flows — sensitive operations can be automated in ways that cause business harm.
- API7: Server Side Request Forgery — an API can be induced to make server-side requests to unintended destinations.
- API8: Security Misconfiguration — unsafe or inconsistent settings in the API stack, supporting infrastructure, or cloud services expose the service to risk.
- API9: Improper Inventory Management — undocumented, forgotten, or outdated API hosts and versions remain in use or exposed.
- API10: Unsafe Consumption of APIs — an integration processes or forwards data from another API without adequate safeguards.
OWASP describes the edition’s prevalence judgments as consensus-based, not statistically measured prevalence figures. It also cautions that the Top 10 does not perform an organization’s risk analysis for it. Prioritize the categories against your own data, business processes, architecture, and threat model rather than treating their order as a measured ranking.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Enforce authorization for each operation
Authentication establishes who is making a request; it does not establish what that caller may do. For every operation, check the caller’s permission to invoke the function, access the specific object, and read or change the requested properties.
#1 Best Overall
- When a request supplies a record identifier, verify that the authenticated caller is entitled to access that particular record. Do not rely on the identifier being difficult to guess.
- For reads, return only properties the caller is allowed to see. For writes, accept only properties the caller is allowed to change.
- Check permission for privileged and administrative functions independently of access to ordinary endpoints.
- Apply these checks to every relevant operation, not just to the user interface or one route that happens to call the API.
Protect communication and harden the API stack
Use TLS for client-to-API traffic and for API connections to upstream or downstream services, including internal communications. Review the configuration of the API components, orchestration, and cloud services that support them, and reassess settings as the environment changes.
Configuration reviews should also address which HTTP methods are accepted, a CORS policy appropriate to browser clients, accepted content types, and consistent request handling across servers and proxies. Define response schemas so that errors do not disclose exception details or other unintended information.
Rank #2
Limit resource use and harmful automation
Capacity protection and protection against business-flow abuse solve different problems. Set resource limits with service capacity, cost exposure, and the effect of downstream actions in mind. Separately identify business operations that could cause harm if automated excessively, then apply safeguards suited to those flows.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →There is no universal rate limit or other numeric threshold established for every API. Choose limits and safeguards for the particular service and review them when its capacity, costs, or business risks change.
Rank #3
Handle third-party APIs as untrusted input
A familiar provider is not a reason to trust every response. An integration can pass unsafe data into later processing or expose sensitive information if it accepts and forwards responses without checks.
- Assess the provider’s security and use TLS for the connection.
- Validate and sanitize returned data before processing it or forwarding it elsewhere.
- Bound the resources spent processing responses and configure timeouts.
- Do not follow redirects blindly; allow them only to approved destinations.
Keep an API inventory through the lifecycle
Maintain current records of API hosts and deployed versions, and document endpoints so owners can identify what is operating and exposed. Include reviews for deprecated versions and debug endpoints that should not remain publicly or internally reachable.
Rank #4
- API Security in Action
- Manning Publications
- ABIS BOOK
Make inventory and configuration review part of ongoing API lifecycle work rather than relying on a one-time assessment. Revisit the records when services, versions, or deployment arrangements change.
Quick Recap
Best Value
Turn the controls into a review sequence
- Map the surface: list API hosts, deployed versions, documented endpoints, integrations, and exposed debug or deprecated components.
- Trace access decisions: for each operation, identify how identity is established and how permission is checked for the function, object, and properties involved.
- Review traffic paths: confirm TLS on client, internal, upstream, and downstream communications, then examine relevant API, proxy, orchestration, and cloud configuration.
- Assess abuse and capacity: identify resource-intensive requests and sensitive business flows, then set service-specific limits and safeguards.
- Inspect integrations: check provider security, response validation and sanitization, processing bounds, timeouts, and redirect destinations.
- Repeat as the API changes: update inventory and reassess configuration and controls when hosts, versions, services, or deployment arrangements change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
