Automated scanners cover parts of the OWASP API Security Top 10 2023, mainly misconfiguration, some authentication weaknesses, resource limits and request forgery probes. Object level and function level authorization, business flow abuse and inventory gaps usually need test scripts or process work. The table below shows a practical split.
The 2023 list
The ten risks are: API1 Broken Object Level Authorization, API2 Broken Authentication, API3 Broken Object Property Level Authorization, API4 Unrestricted Resource Consumption, API5 Broken Function Level Authorization, API6 Unrestricted Access to Sensitive Business Flows, API7 Server Side Request Forgery, API8 Security Misconfiguration, API9 Improper Inventory Management and API10 Unsafe Consumption of APIs.
How to test each
| Risk | Scanner alone | Better approach |
|---|---|---|
| API1 object access | Weak | Two-account swap tests |
| API2 authentication | Partial | Token tamper tests, brute force limits |
| API3 property level | Weak | Add extra fields, read back |
| API4 resource use | Partial | Load and size probes |
| API5 function access | Weak | Low-role token against admin routes |
| API6 business flows | Weak | Abuse case tests per flow |
| API7 SSRF | Partial | Callback probes on URL parameters |
| API8 misconfiguration | Good | Header and CORS checks |
| API9 inventory | Weak | Host and version inventory |
| API10 unsafe consumption | Weak | Review third-party API handling |
The ratings are our judgement, not OWASP's. They reflect that scanners lack knowledge of who owns what.
Steps
- Map your API to the ten risks and write one test per risk that applies.
- Let the scanner cover misconfiguration and common injection probes.
- Script object and function checks using two or three test accounts.
- Review inventory quarterly: hosts, versions and integrations.
- For unsafe consumption, check that your code validates data coming from third-party APIs the same way it validates user input.
Reading the OWASP guidance
OWASP's authentication entry notes that OAuth and API keys do not by themselves provide user authentication, and that password reset endpoints deserve the same brute force protection as login. Those are checks you can add to a test plan today.
Try it yourself
Open the scan results and group them by API risk number.
Click through it at your own pace, or open it full screen.
Quick check
Is the API Top 10 the same as the web Top 10?
No. It is a separate list for APIs, edition 2023, with different categories such as object level authorization.
Which risk should I test first?
Start with object level authorization, because it is the first entry and a common source of data exposure.
Where Safeguard fits
Safeguard offers dependency and SBOM scanning, reachability analysis and policies and gates that can block a pull request, so the libraries behind your app are checked alongside the app itself. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
