REST API Security Checklist — OWASP API Top 10

APIs are the connective tissue of modern applications, and they present a distinct attack surface from the web pages that consume them. The OWASP API Security Top 10 exists because API-specific risks, especially broken authorization at the object and function level, dominate real incidents. An API exposes data and operations directly, so a missing check is not hidden behind a user interface; it is one crafted request away.

Analogy🏏Cricket

🍳 Think of it like cooking: A recipe can look flawless on paper, but a head chef only truly judges the dish by tasting the finished plate, because heat, timing, and the actual oven reveal problems the written method never shows. Just as tasting the cooked result catches what reading the recipe cannot, DAST probes the running application and catches the misconfigurations and runtime behaviour that reading the source cannot. This reveals DAST's stance: it judges the dish as it is actually served, not the recipe as it was merely written.

This lesson surveys the most important API risks and frames them as a practical checklist. The single largest category is broken object level authorization, where an endpoint acts on an identifier without confirming the caller owns it, the API equivalent of the IDOR you met in Module 1. Understanding why APIs concentrate these risks makes the checklist feel less like rote and more like reasoned defence.

Analogy🏏Cricket

💰 Think of it like finance: A real audit that actually attempts a sample transaction proves beyond doubt whether a control can be bypassed, with little room for a false alarm, but it can only test the accounts and processes the auditors actually reach. Just as a hands-on audit yields high-confidence, low-false-positive results yet is bounded by what it examines, DAST yields high-confidence findings about real exploitability yet is bounded by the surface it can reach. This reveals its trade-off: what it confirms is solid, but it only confirms what it manages to touch.