A curated list of the most important API security risks maintained by the OWASP API Security Project. It helps teams prioritise common failure modes such as broken authentication, object-level authorization, inventory gaps, and unsafe third-party consumption. The list is an awareness framework, not a complete control model.
Expanded Definition
OWASP api security Top 10 is a ranked awareness list of high-impact API risk categories, used to help security, engineering, and governance teams focus on the failures most likely to expose data or business logic. It is not a complete API security standard and it does not prescribe every required control, which is why it is most useful as a prioritisation tool rather than a compliance checklist.
The list is especially valuable where APIs sit behind web apps, mobile apps, partner integrations, automation workflows, or AI services. It highlights recurring weaknesses such as broken object-level authorisation, broken authentication, excessive data exposure, and unrestricted resource consumption. Those issues often overlap with identity and access problems, so teams sometimes map the findings alongside the OWASP Non-Human Identity Top 10 when APIs are consumed by service accounts, tokens, or other machine identities.
Definitions vary across vendors and program owners on whether a given issue should be treated as an API design flaw, an access control failure, or a runtime abuse pattern. NHI Management Group treats the term as a security taxonomy for API risk, not as a substitute for architecture reviews, identity governance, or secure SDLC controls. The most common misapplication is using the list as a one-time audit checklist, which occurs when teams assume coverage is complete after naming the top risks once.
Examples and Use Cases
Implementing API security prioritisation rigorously often introduces review overhead, requiring organisations to weigh development speed against stronger threat visibility and access control discipline.
- A banking platform uses the list to test for broken object-level authorisation on customer account APIs, then validates that requests are checked server-side rather than trusted from the client.
- A SaaS provider inventories externally exposed endpoints and discovers forgotten versions, shadow APIs, and test routes, turning the “API inventory” problem into a governance task instead of a cleanup after an incident.
- An identity platform reviews token handling for partner APIs and finds that short-lived credentials, scopes, and audience restrictions need tighter design to reduce blast radius.
- An engineering team aligns API abuse testing with OWASP Agentic AI Top 10 when autonomous agents call internal APIs, because tool access and prompt-driven execution can amplify ordinary API weaknesses.
- A cloud operations team uses the taxonomy to decide where rate limiting, logging, schema validation, and approval workflows should be enforced before broad external exposure.
Why It Matters for Security Teams
API security failures often become enterprise incidents because APIs expose direct paths to data, transactions, and administrative functions. For security teams, the value of the OWASP API Security Top 10 is that it converts a broad attack surface into a shared language for engineering, IAM, application security, and governance. That matters when access control, token design, and object-level permissions are spread across multiple services and ownership boundaries.
The framework also helps teams distinguish between code defects and systemic exposure. If a platform repeatedly ships APIs without clear inventory, authentication hardening, or abuse detection, the issue is rarely a single bug. It is usually a process gap, and the taxonomy gives leadership a way to prioritise remediation and accountability. Where APIs are consumed by non-human identities or AI agents, the risk increases because machine-to-machine access can scale misuse rapidly and silently. The OWASP Non-Human Identity Top 10 and adjacent agentic AI guidance help teams connect API risk with credential lifecycle, privilege boundaries, and tool access.
Organisations typically encounter the full cost of API risk only after an exposed endpoint is abused, at which point the OWASP API Security Top 10 becomes operationally unavoidable to guide containment and redesign.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-4 | API authz and access control failures map to protected access enforcement. |
| NIST SP 800-53 Rev 5 | AC-3 | The list commonly surfaces access enforcement gaps across API endpoints. |
| OWASP Non-Human Identity Top 10 | API risk often depends on service accounts, tokens, and machine identities. | |
| OWASP Agentic AI Top 10 | Agentic systems rely on APIs, so API abuse can become tool misuse. | |
| NIST AI RMF | AI systems consuming APIs need risk governance around misuse and exposure. |
Inventory non-human identities behind APIs and bind each to least-privilege lifecycle controls.
