OWASP API Top 10

The OWASP API Top 10 ranks the ten most critical security risks specific to APIs. The current edition, released in 2023, replaced the original 2019 list after four years of new attack data.

It isn't the same list as the OWASP Mobile Top 10 or the general OWASP Top 10 for web apps. APIs fail in their own specific ways, mostly around authorization logic, not the injection and browser-based risks those other lists center on.

API1: Broken Object Level Authorization

An API commits this violation when it fails to verify that a user can only access objects they're actually authorized to see. It's held the #1 spot since the list began in 2019, and shows up in an estimated 40% of API attacks.

API2: Broken Authentication

Weak or bypassable authentication lets an attacker impersonate a legitimate user, through stolen tokens, credential stuffing, or brute force.

API3: Broken Object Property Level Authorization

This category folds two 2019 risks, Excessive Data Exposure and Mass Assignment, into one, since both share the same root cause: authorization checks that work at the object level but never look at individual properties within it.

API4: Unrestricted Resource Consumption

OWASP renamed this category from 2019's Lack of Resources & Rate Limiting. An API that doesn't limit how much a single caller can request opens the door to both denial-of-service and cost-based abuse.

API5: Broken Function Level Authorization

This category asks whether a user can call an administrative or privileged function they shouldn't have access to, a different question from API1's object-level focus.

API6: Unrestricted Access to Sensitive Business Flows

This is a new category for 2023, covering business logic abuse: an attacker using an API exactly as designed, but at a scale or speed the business logic never anticipated, like scripting a purchase or booking flow.

API7: Server Side Request Forgery (SSRF)

This is also new for 2023, reflecting how common cloud-hosted APIs have become. An API that fetches a URL supplied by the caller can be tricked into making requests to internal infrastructure it should never reach.

API8: Security Misconfiguration

This category serves as the catch-all for unnecessary features left enabled, permissive CORS policies, and verbose error messages, configuration gaps that widen the attack surface without being a specific vulnerability on their own.

API9: Improper Inventory Management

OWASP renamed this category from Improper Assets Management. An organization can't secure an API it doesn't know exists, and old, deprecated, or undocumented "shadow" API versions are exactly the ones nobody's watching.

API10: Unsafe Consumption of APIs

Rounding out the new categories for 2023, this one covers the data an app trusts from third-party APIs it calls, built on the observation that developers validate user input far more carefully than they validate a third-party response.

What changed between 2019 and 2023

Three categories are genuinely new: Unrestricted Access to Sensitive Business Flows, SSRF, and Unsafe Consumption of APIs. One is a merger: Broken Object Property Level Authorization folds 2019's Excessive Data Exposure and Mass Assignment into a single category. Two were renamed without changing much conceptually: Unrestricted Resource Consumption (from Lack of Resources & Rate Limiting) and Improper Inventory Management (from Improper Assets Management).

Injection, present on the general OWASP Top 10, didn't make this cut. Modern frameworks increasingly handle it by default, and its remaining risk likely sits absorbed inside other categories' broader framing rather than gone entirely.

OWASP API Top 10 vs. OWASP Mobile Top 10

Different attack surfaces, with real overlap where they meet.

OWASP Mobile Top 10 covers the mobile app itself: storage, cryptography, binary resilience, the client side. OWASP API Top 10 covers what the app talks to on the way back to a server.

They connect directly. Improper Credential Usage and Insecure Communication, two Mobile Top 10 risks, each have a rough counterpart on the API side: Broken Authentication and Security Misconfiguration, respectively.

A mobile app can pass every Mobile Top 10 check and still fail badly on the API side, since the two lists test different halves of the same conversation.

For the mobile-specific list, see What is OWASP Mobile Top 10?

Where Appknox fits

Appknox's API security testing maps every finding to the specific OWASP API Top 10 category it falls under, tested against the actual backend endpoints a mobile app calls, including ones never surfaced in the app's own UI.

See the full testing methodology: Appknox Automated Vulnerability Assessment.

Frequently asked questions

What is the OWASP API Top 10?

The OWASP API Top 10 is a list published by OWASP that ranks the ten most critical security risks specific to APIs. The current edition, from 2023, replaced the original 2019 list.

What's #1 on the OWASP API Top 10?

Broken Object Level Authorization (BOLA), which has held the top spot since the list began in 2019 and shows up in an estimated 40% of API attacks.

What changed between the 2019 and 2023 editions?

Three categories are new: Unrestricted Access to Sensitive Business Flows, Server Side Request Forgery, and Unsafe Consumption of APIs. One is a merger of two 2019 categories, and two others were renamed.

Is the OWASP API Top 10 the same as the OWASP Mobile Top 10?

No. Mobile Top 10 covers the mobile app itself. API Top 10 covers the backend APIs it talks to. They cover different halves of the same system.

Does Appknox test against the OWASP API Top 10?

Yes. Appknox's API security testing maps every finding to the specific OWASP API Top 10 category it falls under.

Related: What is Mobile API Security? | What is OWASP Mobile Top 10? | Appknox Automated Vulnerability Assessment

By Aadarsh Anand, Security Researcher, Appknox Security Research Team

Appknox is an enterprise mobile application security testing platform. This page was written by Appknox's security research team based on direct experience mapping automated testing findings to the OWASP API Top 10 across financial services, healthcare, and enterprise mobile app portfolios.

This page was drafted with AI assistance and reviewed and verified by the Appknox security research team.