API Security: The OWASP API Security Top 10 (2023)

Step 1: See the 2023 list

Notice that the top items are all about authorization and authentication: who may access which object, property, and function.

API1:2023  Broken Object Level Authorization
API2:2023  Broken Authentication
API3:2023  Broken Object Property Level Authorization
API4:2023  Unrestricted Resource Consumption
API5:2023  Broken Function Level Authorization
API6:2023  Unrestricted Access to Sensitive Business Flows
API7:2023  Server Side Request Forgery
API8:2023  Security Misconfiguration
API9:2023  Improper Inventory Management
API10:2023 Unsafe Consumption of APIs

Step 2: Prevent object, property, and function-level flaws

Broken Object Level Authorization, often called BOLA, means an endpoint accepts an object identifier and returns it without checking that the caller may access it, so check ownership on every request. Broken Object Property Level Authorization covers returning too many fields, or letting clients set fields they should not, such as a role. Broken Function Level Authorization means privileged endpoints are reachable by ordinary users, so enforce role checks on every function, not just in the interface.

Step 3: Return only the fields you intend

Define explicit response models rather than serializing whole database objects. Define the allowed input fields too, and reject unknown ones, which prevents mass assignment. This example uses a response model that exposes only safe fields.

from pydantic import BaseModel

class PublicUser(BaseModel):
    id: int
    display_name: str          # no email, role, or internal flags

def get_user(user_id: int) -> PublicUser:
    user = db.get_user(user_id)            # full record, including private data
    return PublicUser.model_validate(user, from_attributes=True)

Step 4: Limit resources and protect business flows

Unrestricted Resource Consumption means no limits on request rates, payload sizes, pagination, or expensive operations, which allows denial of service and large cloud bills. Apply rate limits, size limits, timeouts, and maximum page sizes. Unrestricted Access to Sensitive Business Flows covers automated abuse of legitimate functions, such as bulk ticket buying or mass account creation, which needs bot detection and per-flow limits.

Step 5: Control requests, inventory, and third parties

Server Side Request Forgery happens when an API fetches a URL supplied by a user, letting attackers reach internal services, so allow-list destinations and block internal address ranges. Security Misconfiguration covers verbose errors, permissive CORS, and missing headers. Improper Inventory Management means forgotten old versions and undocumented endpoints stay exposed, so keep an inventory and retire old versions. Unsafe Consumption of APIs means trusting data from third-party APIs, so validate everything you receive from them as you would user input.