OWASP API Security Top 10 (2023)

1. API1 Broken Object Level Authorization

   BOLA, object ID manipulation and per-object authorization checks.

2. API2 Broken Authentication

   Weak API authentication, token handling, credential stuffing and missing rate limiting on auth endpoints.

3. API3 Broken Object Property Level Authorization

   Excessive data exposure and mass assignment at the property level.

4. API4 Unrestricted Resource Consumption

   Rate limiting, payload size limits, pagination caps and cost-based denial of service.

5. API5 Broken Function Level Authorization

   Admin versus user endpoint separation and role-based function access.

6. API6 Unrestricted Access to Sensitive Business Flows

   Automated abuse of business flows such as purchasing, scalping and referral abuse.

7. API7 Server Side Request Forgery

   SSRF through API parameters fetching remote resources and URL allow-lists.

8. API8 Security Misconfiguration

   Missing hardening, permissive CORS, verbose errors and unpatched API infrastructure.

9. API9 Improper Inventory Management

   Shadow and deprecated API versions, documentation and environment exposure.

10. API10 Unsafe Consumption of APIs

    Trusting third-party API responses, validating upstream data and redirect handling.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.