OWASP API Security Top 10 (2023), explained

Last updated: 2026-10-27

The OWASP API Security Top 10 is an awareness document from the OWASP API Security Project listing the ten security risks the project considers most important for APIs specifically, distinct from the main OWASP Top 10's broader web-application focus. Per its own introduction, its goal is "to educate those involved in API development and maintenance, for example, developers, designers, architects, managers, or organizations." The first edition was published in 2019; the current, second edition was released 3 July 2023. The document is licensed under Creative Commons Attribution-ShareAlike 4.0 (CC BY-SA 4.0), per the project's GitHub repository.

The 10 categories (2023 edition)

Risk	Name	OWASP's own description
API1:2023	Broken Object Level Authorization	"APIs tend to expose endpoints that handle object identifiers, creating a wide attack surface of Object Level Access Control issues."
API2:2023	Broken Authentication	"Authentication mechanisms are often implemented incorrectly, allowing attackers to compromise authentication tokens or exploit implementation flaws."
API3:2023	Broken Object Property Level Authorization	"Lack of or improper authorization validation at the object property level leads to information exposure or manipulation by unauthorized parties."
API4:2023	Unrestricted Resource Consumption	"Successful attacks can lead to Denial of Service or an increase of operational costs through excessive consumption of APIs."
API5:2023	Broken Function Level Authorization	"Complex access control policies with unclear separation between administrative and regular functions tend to lead to authorization flaws."
API6:2023	Unrestricted Access to Sensitive Business Flows	"APIs expose business flows without compensating for how functionality could harm the business if used excessively in an automated manner."
API7:2023	Server Side Request Forgery	"SSRF flaws occur when an API fetches remote resources without validating user-supplied URIs, enabling crafted malicious requests."
API8:2023	Security Misconfiguration	"Complex configurations meant to customize APIs can be missed or mishandled by engineers, opening doors to various attack vectors."
API9:2023	Improper Inventory Management	"APIs expose more endpoints than traditional web applications, making proper documentation and inventory of hosts and versions critical."
API10:2023	Unsafe Consumption of APIs	"Developers adopt weaker security standards for third-party API data than user input, making integrated services attractive attack targets."

What changed from the 2019 edition

OWASP's own release notes describe the 2023 edition arriving "exactly four years after" the 2019 first release, with several structural changes:

Merged: 2019's Excessive Data Exposure and Mass Assignment were combined into API3:2023 Broken Object Property Level Authorization — the release notes state the merge targets their "common root cause: object property level authorization validation failures."
New: API6:2023 Unrestricted Access to Sensitive Business Flows, covering threats like scalping and fake-account creation that a narrow rate-limiting discussion didn't capture, and API10:2023 Unsafe Consumption of APIs, covering risk from trusting data returned by third-party or integrated APIs.
Broadened scope: resource consumption shifted from a narrower focus on request rate toward the fuller range of resources (compute, memory, storage, third-party API costs) a single API call can consume.

Three out of the top five 2023 entries involve authorization in some form (object level, object property level, and function level) — a theme OWASP's own announcement attributes to increasingly complex APIs exposing thousands of endpoints, each a potential access-control decision point.

How the ranking was produced

OWASP's Methodology and Data page is explicit that this is not a purely statistical ranking. The project ran a public Call for Data from September to November 2022, but states plainly: "this call for data did not result in data that would have enabled a relevant statistical analysis." The team instead combined a review of publicly available API security incident data from 2019–2022 with internal and community discussion of emerging trends, then applied the OWASP Risk Rating Methodology — with "prevalence ratings decided from a consensus among the project team members, based on their experience in the field" — before the draft went through expert and community review as a Release Candidate. This matters for how an organization should use the list: it is a curated, expert-driven snapshot of what practitioners see as the most important API-specific risks, not a reproducible statistical frequency count.

Using it alongside device/firmware API surfaces

Device makers increasingly expose management or cloud-sync APIs alongside firmware — the same object- and function-level authorization failures (API1, API3, API5) that dominate this list show up in device management backends, not just conventional SaaS APIs, and Unsafe Consumption of APIs (API10) is directly relevant wherever a device or gateway consumes data from a cloud or third-party API without the same scrutiny applied to direct user input.

SoftWSP's device and firmware security work includes reviewing the APIs a device or its companion backend exposes against categories like these, rather than treating firmware and its API surface as separate review scopes: see device firmware security.

This guide summarises a public OWASP document; it does not constitute legal or compliance advice.

Frequently asked questions

What is the OWASP API Security Top 10?

An awareness document published by the OWASP API Security Project. Per its own introduction, "the primary goal of the OWASP API Security Top 10 is to educate those involved in API development and maintenance, for example, developers, designers, architects, managers, or organizations" about the most important security risks specific to APIs. The first edition was published in 2019; the current edition, released 3 July 2023, is the second. It is licensed under Creative Commons Attribution-ShareAlike 4.0 (CC BY-SA 4.0), per the project's GitHub repository.

What are the 10 categories in the 2023 edition?

Per OWASP's own Top 10 API Security Risks – 2023 page: API1:2023 Broken Object Level Authorization, API2:2023 Broken Authentication, API3:2023 Broken Object Property Level Authorization, API4:2023 Unrestricted Resource Consumption, API5:2023 Broken Function Level Authorization, API6:2023 Unrestricted Access to Sensitive Business Flows, API7:2023 Server Side Request Forgery, API8:2023 Security Misconfiguration, API9:2023 Improper Inventory Management, and API10:2023 Unsafe Consumption of APIs.

What changed between the 2019 and 2023 editions?

OWASP's own release notes describe the 2023 edition as arriving "exactly four years after" the 2019 edition's first release. The two 2019 categories Excessive Data Exposure and Mass Assignment were merged into the new API3:2023 Broken Object Property Level Authorization, which the release notes describe as focusing on their "common root cause: object property level authorization validation failures." Two categories are entirely new: API6:2023 Unrestricted Access to Sensitive Business Flows (addressing threats like scalping and fake-account creation that rate-limiting discussions alone didn't capture) and API10:2023 Unsafe Consumption of APIs (risk from trusting data returned by third-party/integrated APIs). The remaining categories carried forward with updated detail, and resource consumption shifted from a narrow focus on request rate to the broader scope of what resources an API call can consume.

How was the 2023 ranking produced — is it data-driven like the main OWASP Top 10?

OWASP's own Methodology and Data page states the project ran a public Call for Data from September to November 2022, but reports plainly that "this call for data did not result in data that would have enabled a relevant statistical analysis." The 2023 list is therefore primarily expert-consensus based: the project team reviewed publicly available API security incident data from 2019–2022, discussed emerging trends internally and with the community, and applied the OWASP Risk Rating Methodology, with "prevalence ratings decided from a consensus among the project team members, based on their experience in the field," before the draft went through expert and community review as a Release Candidate.