OWASP API Security Top 10 - 2023 Prevention¶
This page maps the OWASP API Security Top 10 - 2023 categories to the Secure Coding Guide. The API list complements (it does not replace) the OWASP Top 10 - 2025 Prevention mapping.
| # | Category | Section in the Secure Coding Guide |
|---|---|---|
| API1 | Broken Object Level Authorization | Object-level access control (IDOR) |
| API2 | Broken Authentication | Authentication Failures |
| API3 | Broken Object Property Level Authorization | Object property-level access control (mass assignment) |
| API4 | Unrestricted Resource Consumption | Pagination, list limits, and resource ceilings |
| API5 | Broken Function Level Authorization | Missing Function Level Access Control |
| API6 | Unrestricted Access to Sensitive Business Flows | Sensitive business flows and anti-automation |
| API7 | Server Side Request Forgery | Server Side Request Forgery (SSRF) |
| API8 | Security Misconfiguration | Security Misconfiguration |
| API9 | Improper Inventory Management | API inventory, versioning, deprecation |
| API10 | Unsafe Consumption of APIs | Unsafe consumption of upstream APIs |