thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

OWASP API Security Top 10

OWASP's list of the ten most critical security risks specific to APIs, last updated in 2023.

Definition

The 2023 list is: API1 Broken Object Level Authorization, API2 Broken Authentication, API3 Broken Object Property Level Authorization, API4 Unrestricted Resource Consumption, API5 Broken Function Level Authorization, API6 Unrestricted Access to Sensitive Business Flows, API7 Server-Side Request Forgery, API8 Security Misconfiguration, API9 Improper Inventory Management and API10 Unsafe Consumption of APIs. Authorization flaws dominate the list.

Example

An API security review maps each finding to an API Top 10 category in its report.

Exam tip

BOLA is API1; three of the ten categories are authorization failures.

Related terms