simpl.
Sign in
Cybersecurity GRC 13 items

API Security Assessment (OWASP API Top 10)

Assesses REST and GraphQL API security against the OWASP API Security Top 10 (2023), focusing on authorization, authentication, and resource controls.

OWASP API Security Top 10NIST 800-53

Free PDF · enter your email to download.

Authorization

  • Is object-level authorization enforced so users can only access their own objects? *
  • Is function-level authorization enforced across all endpoints and methods? *
  • Are property-level authorization checks applied to prevent mass assignment? *

Authentication

  • Are authentication endpoints protected against credential stuffing and brute force? *
  • Are API tokens and keys short-lived, scoped, and securely stored? *
  • Is JWT signature and expiration validation enforced? *

Resource & Consumption Controls

  • Is rate limiting and throttling applied to prevent abuse? *
  • Are payload size, pagination, and query depth limits enforced? *
  • Are server-side request forgery risks mitigated on APIs that fetch remote resources? *

Inventory & Configuration

  • Is a complete inventory of API endpoints and versions maintained? *
  • Are deprecated and non-production API versions decommissioned? *
  • Are security misconfigurations (verbose errors, CORS, missing headers) remediated? *
  • Is data returned by APIs filtered to expose only necessary fields?

Download the full API Security Assessment (OWASP API Top 10) checklist

Get it as a clean, printable PDF — free.