Skip to content API Security Misconfiguration incident response playbook · Cybersecurity AtlasAPI Security Misconfiguration
HighAPI SecurityOWASP API Security Top 10
APIs expose excessive data, lack authentication, allow unrestricted method access, or have missing rate limiting - enabling data harvesting, privilege abuse, and account takeover.
- 1Rate-limit or temporarily block clients showing enumeration behavior.
- 2Audit API logs to assess the scope of unauthorized data access.
- 3Revoke API keys from suspicious clients.
Implement object-level authorization checks on every API endpoint.
2Apply strict rate limiting and throttling on all public API endpoints.3Use an API gateway to enforce authentication, authorization, and rate limiting centrally.4Remove or mask fields in API responses that are not required by the consuming client.- 1Adopt an API security standard and testing checklist (OWASP API Security Top 10).
- 2Integrate API-specific DAST tools into the CI/CD pipeline.
- 3Review all API schemas and enforce response data minimization.
- 4Implement API inventory management to track all internal and external API surfaces.
- BOLA (Broken Object Level Authorization): accessing other users' objects via ID manipulation
- Lack of rate limiting enabling mass data enumeration
- Unauthenticated or under-authenticated internal API endpoints
- Overexposed API responses returning fields not required by the client
- Unusually high API request volume from a single client
- Sequential or predictable object ID enumeration in API access logs
- API endpoints returning fields tagged as internal or administrative to regular users
42CrunchOWASP ZAP API ScanPostman SecurityAktoSalt Security
