OWASP API Top 10

Hand-drawn sketch: Change the number, get the parcel. An API hands out objects on request. Whose object is the question.

A separate API list exists because API risks genuinely differ in kind from web application risks.

The dominant problems are authorisation at the object level, excessive data exposure and unrestricted resource consumption, none of which are the classic injection flaws. Applying web application thinking to APIs consistently misses the categories that actually cause API breaches.

Checked against the primary source.

OWASP API Top 10

More on Frameworks & standards