Security training for API developers should start with authorization, because the OWASP API Security Top 10 2023 puts object level, property level and function level authorization failures in its first, third and fifth positions. Then cover authentication, resource limits, SSRF, configuration, inventory and the safe use of third party APIs.
Why API developers need their own track
General secure coding training leans on web page examples: forms, cookies, templates. An API developer rarely writes any of that. Their bugs live in route handlers, token checks and the shape of JSON responses. A generic course spends time on cross site scripting while the team's real risk is that user A can fetch user B's invoice by changing an id.
The OWASP API Security Top 10 2023 is a good backbone because it was written for this problem. It is a list of risk categories, not a full curriculum, so treat it as the table of contents and add exercises.
The topic list, in teaching order
| Order | Topic | OWASP API 2023 item |
|---|---|---|
| 1 | Object ownership checks on every lookup | API1 Broken Object Level Authorization |
| 2 | Which fields a caller may read or write | API3 Broken Object Property Level Authorization |
| 3 | Role checks on every endpoint | API5 Broken Function Level Authorization |
| 4 | Login, tokens, session handling | API2 Broken Authentication |
| 5 | Rate and size limits | API4 Unrestricted Resource Consumption |
| 6 | Abuse of legitimate business flows | API6 Unrestricted Access to Sensitive Business Flows |
| 7 | Server side fetches of user supplied URLs | API7 Server Side Request Forgery |
| 8 | Headers, CORS, verbose errors, defaults | API8 Security Misconfiguration |
| 9 | Knowing every version and host you expose | API9 Improper Inventory Management |
| 10 | Trusting data from upstream APIs | API10 Unsafe Consumption of APIs |
The order is a judgment call, not part of the OWASP list. Authorization comes first because it is the category a scanner finds least reliably and a reviewer finds most easily, which makes it a good place for human skill to pay off.
Make each topic a small exercise
Reading a list does not change how someone writes a handler. For each topic, give developers a tiny failing example and ask them to fix it.
- Show an endpoint that returns a record by id with no ownership check. Ask for the one line fix, then ask where else the same mistake could hide.
- Show an update endpoint that binds the whole request body to a model. Ask which fields should never be writable.
- Show an endpoint that fetches a URL from a request parameter. Ask what an attacker could point it at inside your network.
- Show an old API version still reachable in production. Ask who owns it and when it goes away.
Keep each exercise under fifteen minutes. Use your own code, with names changed, whenever you can. Real shapes are more memorable than invented ones.
What to leave out of the first pass
Skip cryptographic theory, protocol internals and full penetration testing technique. API developers need to recognise the mistake and know the fix pattern. Depth can come later, driven by what your own findings show.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how a finding names the endpoint and the category. Findings like these make good exercise material once you have anonymised them.
Where Safeguard fits
Training teaches the habit. Findings show where the habit is missing. Safeguard includes API security scanning and dependency scanning, and you can try a free scan at gold.safeguard.sh/scan to see what your own code produces before you design exercises.
Quick check
Should API training come before or after general secure coding training?
After a short general base, or alongside it. The API track is where the highest value risks for service teams sit, so do not make people wait months for it.
Is the OWASP API list enough as a full curriculum?
No. It names risk categories. You still need exercises, fix patterns and your own examples to turn each category into a skill.
Sources
- OWASP API Security Top 10 2023: api-security.owasp.org/editions/2023/en/0x11-t10
Last reviewed: 19 October 2026.
