⌁ API For Work
← All API tools
🛡️
Security

OWASP API Top 10 Assessment

Guided API security self-assessment with passive checks.

OWASP API Security Top 10 — 2023

Answer based on your API's actual controls. This is a guided self-assessment, not an automated penetration test.

1
API1:2023

Broken Object Level Authorization

Are object-level authorization checks enforced server-side whenever a user references an object ID?

2
API2:2023

Broken Authentication

Are authentication tokens, sessions and credential flows strongly validated, expired and protected?

3
API3:2023

Broken Object Property Level Authorization

Do you control which object properties each user may read or modify?

4
API4:2023

Unrestricted Resource Consumption

Are request rates, payload sizes and expensive operations limited to prevent excessive resource use?

5
API5:2023

Broken Function Level Authorization

Are privileged functions restricted by server-side role or permission checks?

6
API6:2023

Unrestricted Access to Sensitive Business Flows

Are sensitive business workflows protected against automation and excessive use?

7
API7:2023

Server Side Request Forgery

Are server-side outbound URLs validated and private/internal network destinations blocked?

8
API8:2023

Security Misconfiguration

Are TLS, CORS, error handling, unnecessary features and security settings reviewed and hardened?

9
API9:2023

Improper Inventory Management

Do you maintain an accurate inventory of API versions, endpoints, hosts and deprecated interfaces?

10
API10:2023

Unsafe Consumption of APIs

Do you validate and constrain data received from third-party APIs before trusting or using it?

Advertisement

What is OWASP API Top 10 Assessment?

The OWASP API Top 10 Assessment is a guided self-assessment based on the OWASP API Security Top 10 2023 categories. You answer questions about your implementation and can optionally add a public endpoint for limited passive observations.

What this tool checks

  • Object-level authorization controls
  • Authentication controls
  • Object property authorization
  • Resource-consumption limits
  • Function-level authorization
  • Sensitive business-flow protection
  • Server-side request controls
  • Security configuration
  • API inventory management
  • Safe consumption of third-party APIs

How to use it

  1. Answer each control question based on your actual implementation.
  2. Optionally provide a public endpoint for passive observations.
  3. Generate the assessment.
  4. Use identified gaps as review items for your development or security team.
Important: The resulting percentage measures questionnaire coverage. It is not proof of OWASP compliance and does not replace code review, architecture review or penetration testing.

Frequently asked questions

Is this an automated OWASP scanner?

No. It is primarily a guided self-assessment with a small set of passive endpoint observations.

Which OWASP API list does it use?

The questions are organized around the OWASP API Security Top 10 2023 categories.

Related API tools

⚡ Quick API Audit Run multiple API health and security checks from one URL. 🔒 API Security Headers Checker Analyze security-related HTTP response headers. 🔌 API Endpoint Tester Send requests and inspect status, headers, JSON and timing. 🌐 CORS Security Checker Inspect cross-origin response and preflight behavior. ⏱️ API Rate Limit Checker Inspect rate-limit responses and headers with safe request caps. 🔑 API Authentication Exposure Checker Observe how an endpoint behaves without credentials.