OWASP API Security Project
What is API Security?
A foundational element of innovation in today’s app-driven world is the API. From banks, retail and transportation to IoT, autonomous vehicles and smart cities, APIs are a critical part of modern mobile, SaaS and web applications and can be found in customer-facing, partner-facing and internal applications. By nature, APIs expose application logic and sensitive data such as Personally Identifiable Information (PII) and because of this have increasingly become a target for attackers. Without secure APIs, rapid innovation would be impossible.
API Security focuses on strategies and solutions to understand and mitigate the unique vulnerabilities and security risks of Application Programming Interfaces (APIs).
247arjun, abunuwas, Alissa Knight, Arik Atar, aymenfurter, Corey J. Ball, cyn8,
d0znpp, Dan Gordon, donge, Dor Tumarkin, faizzaidi, gavjl, guybensimhon, Inês
Martins, Isabelle Mauny, Ivan Novikov, jmanico, Juan Pablo, k7jto, LaurentCB,
llegaz, Maxim Zavodchik, MrPRogers, planetlevel, rahulk22, Roey Eliyahu, Roshan
Piyush, securitylevelup, sudeshgadewar123, Tatsuya-hasegawa, tebbers, vanderaj,
wenz, xplo1t-sec, Yaniv Balmas, ynvb
007divyachawla, Abid Khan, Adam Fisher, anotherik, bkimminich, caseysoftware,
Chris Westphal, dsopas, DSotnikov, emilva, ErezYalon, flascelles, Guillaume
Benats, IgorSasovets, Inonshk, JonnySchnittger, jmanico, jmdx, Keith Casey,
kozmic, LauraRosePorter, Matthieu Estrade, nathanawmk, PauloASilva, pentagramz,
philippederyck, pleothaud, r00ter, Raj kumar, Sagar Popat, Stephen Gates,
thomaskonrad, xycloops123, Raphael Hagi, Eduardo Bellis, Bruno Barbosa
Project Resources
- Documentation
- GitHub
- API1:2023 - Broken Object Level Authorization
- API2:2023 - Broken Authentication
- API3:2023 - Broken Object Property Level Authorization
- API3:2019 Excessive Data Exposure
- API6:2019 - Mass Assignment
- API4:2023 - Unrestricted Resource Consumption
- API5:2023 - Broken Function Level Authorization
- API6:2023 - Unrestricted Access to Sensitive Business Flows
- API7:2023 - Server Side Request Forgery
- API8:2023 - Security Misconfiguration
- API9:2023 - Improper Inventory Management
- API10:2023 - Unsafe Consumption of APIs
- Creative Commons Attribution-ShareAlike 4.0 license
Project Information
Production Project
Classification
API Security
Language
Markdown
License
CC-BY-SA-4.0
Latest Version
2023
Contributors
31
GitHub Stars
2300
OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.
SlackOWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.
© 2026, OWASP Foundation Inc. All rights reserved.