The OWASP API Security Top 10 is a list, produced by OWASP, that identifies and ranks the ten most critical security risks specific to Application Programming Interfaces (APIs). It exists because APIs face threats that differ meaningfully from those affecting traditional web applications, and the general OWASP Top 10 for web applications does not adequately capture API-specific risks. First released to address this gap and subsequently updated to reflect the evolving threat landscape, the API Security Top 10 has become the industry’s standard reference for understanding and prioritizing API security threats.
The list arose from the recognition that APIs expose application logic and data directly, often bypassing the user-interface layer, and that they authenticate and authorize requests in ways that create distinctive vulnerabilities. Whereas classic web application risks often center on issues like injection and cross-site scripting, API risks are dominated by authorization and business-logic failures – where individual requests are well-formed and valid, but the application fails to properly enforce who may access what.
The most prominent and consistently top-ranked risk is Broken Object Level Authorization (BOLA), where an API fails to verify that a user is authorized to access the specific object they request, allowing attackers to reach other users’ data by manipulating identifiers. Other key risks across the list include Broken Authentication (weaknesses in how APIs verify identity, enabling impersonation and account takeover), Broken Object Property Level Authorization (which consolidated the earlier excessive data exposure and mass assignment risks, focusing on missing authorization at the property level), Unrestricted Resource Consumption (formerly lack of resources and rate limiting, concerning denial-of-service and cost abuse), Broken Function Level Authorization (users invoking privileged functions they should not be able to reach), Unrestricted Access to Sensitive Business Flows (automated abuse of legitimate business functionality), Server-Side Request Forgery, Security Misconfiguration, Improper Inventory Management (unknown, undocumented, or deprecated APIs left exposed), and Unsafe Consumption of APIs (trusting data from third-party APIs too readily).
The value of the OWASP API Security Top 10 lies in giving organizations a prioritized, authoritative understanding of where API risk concentrates – overwhelmingly in authorization and business logic – so they can focus defensive efforts effectively. It provides a common vocabulary for developers, security teams, and tools; guides secure API design, testing, and monitoring; and informs many API security products and programs. Notably, because so many of these risks are logic- and authorization-based rather than signature-detectable, the list underscores why traditional perimeter tools like WAFs and gateways are insufficient on their own, and why API security requires context-aware controls that understand each API’s data model, workflows, and authorization rules.