Curriculum · Phase 6 · Module 6.3

OWASP API Security Top 10 (2023)

The OWASP API Security Top 10 is the shared vocabulary auditors, pentesters, and engineers use to talk about API risk. This module walks all ten categories — from Broken Object Level Authorization (BOLA) to Unsafe Consumption of APIs — with a concrete example of each and the evidence that proves it is mitigated. You then find seeded flaws in a mock API specification and map each to its Top 10 category.