[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572072-105":53,"doc-detail-572072-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","owasp-api-security-top-10-2019-the-ten-most-critical-api-security-risks","OWASP API Security Top 10 - 2019 - The Ten Most Critical API Security Risks","","The Ten Most Critical API Security Risks presents the first edition of the OWASP API Security Top 10-2019, focusing on vulnerabilities unique to APIs. It explains why APIs expose logic and sensitive data such as PII, making them frequent targets for attackers, and why a dedicated API-specific risks list is needed for secure development and adoption. The document outlines the top ten risk categories, from authorization and authentication failures to excessive data exposure, injection, misconfiguration, improper asset management, and insufficient logging and monitoring.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/owasp-api-security-top-10-2019-the-ten-most-critical-api-security-risks/572072/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/owasp-api-security-top-10-2019-the-ten-most-critical-api-security-risks/572072.png","ImageObject",442,249,{"name":88,"@type":89},"Bulrr","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-22","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":47},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"Why does OWASP require an API-specific security risks list?","Question",{"text":108,"@type":109},"APIs expose application logic and sensitive data such as PII, making them increasingly attractive to attackers. Because of this unique nature, a dedicated API security risks list is required beyond the broader web application Top 10.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"What is the purpose of the OWASP API Security Top 10-2019?",{"text":113,"@type":109},"It aims to improve readability and adoption by highlighting the most critical API security risks. It also guides developers on strategies to understand and mitigate API-specific vulnerabilities and threats.",{"name":115,"@type":106,"acceptedAnswer":116},"Which kinds of risks are covered by the OWASP API Security Top 10-2019?",{"text":117,"@type":109},"The list includes authorization and authentication failures, excessive data exposure, rate limiting and resource issues, mass assignment, security misconfiguration, injection flaws, improper asset management, and insufficient logging and monitoring.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},572072,1792337912,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":47,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":8},5909892115043,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","The Ten Most Critical API Security Risks  \n TOC Table of Contents  \nTable of Contents  \nTOC Table of Contents...............................................2  \nFW Foreword.............................................................3  \nI Introduction..............................................................4  \nRN Release Notes.......................................................5  \nRISK API Security Risk.............................................6  \nT10 OWASP API Security Top 10-2019..................7  \nAPI1:2019 Broken Object Level Authorization.........8  \nAPI2:2019 Broken User Authentication...................10  \nAPI3:2019 Excessive Data Exposure.......................12  \nAPI4:2019 Lack of Resources & Rate Limiting......14  \nAPI5:2019 Broken Function Level Authorization...16  \nAPI6:2019 Mass Assignment...................................18  \nAPI7:2019 Security Misconfiguration.....................20  \nAPI8:2019 Injection.................................................22  \nAPI9:2019 Improper Assets Management................24  \nAPI10:2019 Insufficient Logging & Monitoring.....26  \n+D What’s Next for Developers...............................28  \n+DSO What’s Next for DevSecOps.........................29  \n+DAT Methodology and Data..................................30  \n+ACK Acknowledgments........................................31  \nAbout OWASP  \nThe Open Web Application Security Project (OWASP) is an open community dedicated to enabling organizations to develop, purchase, and maintain applications and APIs that can be trusted. At OWASP, you'll find free and open:  \n• Application security tools and standards.  \n• Complete books on application security testing, secure code development, and secure code review.  \n• Presentations and videos.  \n•  Cheat sheets on many common topics.  \n• Standard security controls and libraries.  \n•  Local chapters worldwide.  \n• Cutting edge research.  \n• Extensive conferences worldwide.  \n•  Mailing lists.  \nLearn more at: [https://www.owasp.org](https://www.owasp.org).  \nAll OWASP tools, documents, videos, presentations, and chapters are free and open to anyone interested in improving application security.  \nWe advocate approaching application security as a people, process, and technology problem because the most effective approaches to application security require improvements in these areas.  \nOWASP is a new kind of organization. Our freedom from commercial pressures allows us to provide unbiased, practical, and cost-effective information about application security.  \nOWASP is not affiliated with any technology company, although we support the informed use of commercial security technology. OWASP produces many types of materials in a collaborative, transparent, and open way.  \nThe OWASP Foundation is the non-profit entity that ensures the project's long-term success. Almost everyone associated with OWASP is a volunteer, including the OWASP board, chapter leaders, project leaders, and project members.  \nWe support innovative security research with grantsand infrastructure.  \nCome join us!  \n[https://owasp.org](https://owasp.org This work)[ This work](https://owasp.org This work) is licensed under a  \nCreative Commons Attribution ShareAlike 4.0 International License  \nFW  Foreword  \nA foundational element of innovation in today’s app-driven world is the Application Programming Interface (API) . From banks, retail, and transportation to IoT, autonomous vehicles, and smart cities, APIs are a critical part of modern mobile, SaaS, and web applications and can be found in customer-facing, partner-facing, and internal applications.  \nBy nature, APIs expose application logic and sensitive data such as Personally Identifiable Information (PII) and because of this, APIs have increasingly become a target for attackers. Without secure APIs, rapid innovation would be impossible.  \nAlthough a broader web application security risks Top 10 still makes sense, due to their particular nature, an API-spe","cbCaiqcWZijPV7IG","https://ap.wps.com/l/cbCaiqcWZijPV7IG","pdf",3331066,31,"English","# Foreword\n# Introduction\n# Release Notes\n# API Security Risk\n# OWASP API Security Top 10-2019\n## API1:2019 Broken Object Level Authorization\n## API2:2019 Broken User Authentication\n## API3:2019 Excessive Data Exposure\n## API4:2019 Lack of Resources & Rate Limiting\n## API5:2019 Broken Function Level Authorization\n## API6:2019 Mass Assignment\n## API7:2019 Security Misconfiguration\n## API8:2019 Injection\n## API9:2019 Improper Assets Management\n## API10:2019 Insufficient Logging & Monitoring\n# What’s Next for Developers\n# What’s Next for DevSecOps\n# Methodology and Data\n# Acknowledgments","[{\"question\":\"Why does OWASP require an API-specific security risks list?\",\"answer\":\"APIs expose application logic and sensitive data such as PII, making them increasingly attractive to attackers. Because of this unique nature, a dedicated API security risks list is required beyond the broader web application Top 10.\"},{\"question\":\"What is the purpose of the OWASP API Security Top 10-2019?\",\"answer\":\"It aims to improve readability and adoption by highlighting the most critical API security risks. It also guides developers on strategies to understand and mitigate API-specific vulnerabilities and threats.\"},{\"question\":\"Which kinds of risks are covered by the OWASP API Security Top 10-2019?\",\"answer\":\"The list includes authorization and authentication failures, excessive data exposure, rate limiting and resource issues, mass assignment, security misconfiguration, injection flaws, improper asset management, and insufficient logging and monitoring.\"}]","OWASP API Security Top 10 - 2019 - The Ten Most Critical API Security Risks | PDF",1791925336]