API Security Checklist

Assess your REST or GraphQL API against the OWASP API Top 10 (2023) — authentication, authorization, rate limiting, data exposure, and infrastructure hardening.

Context

These answers determine which security controls are relevant to your API.

Does the API handle user-specific data (accounts, profiles, private content, or anything tied to an individual identity)?

Yes

Does the API make outbound server-side requests based on user-supplied input (URLs, IP addresses, file paths, etc.)?

Yes

Authentication & Authorization

Controls that verify identity and enforce access to specific resources and actions.

Is authentication required for all endpoints that are not intentionally public?

Endpoints with no authentication requirement should be a deliberate, documented decision — not an oversight.

Yes

Are auth tokens validated server-side on every request — not just checked for correct format or presence?

This includes verifying signature, expiry, scope, and revocation status where applicable.

Yes

Are function-level checks enforced so admin or privileged endpoints are inaccessible to regular users?

Yes

Data Exposure & Input Validation

Controls that limit what data the API returns and what input it accepts.

Do API responses include only the fields the client needs — no unintentional extra properties?

Returning full database rows or ORM objects without field filtering is a common source of data leakage.

Yes

Is input validated on all parameters — type, length, format, and allowed value ranges?

Applies to query params, path params, request body, and headers.

Yes

Do error responses avoid leaking internal implementation details — stack traces, SQL errors, file paths, or server names?

Yes

Rate Limiting & Resource Management

Controls that prevent abuse through excessive or malicious API consumption.

Are rate limits enforced on API endpoints to prevent automated abuse or denial-of-service?

Yes

Are limits enforced on payload size and pagination depth (e.g., max page size for list endpoints)?

Yes

Are resource-intensive operations (bulk exports, file uploads, complex queries) throttled, queued, or otherwise protected?

Yes

Business Logic & Access Control

Controls that protect sensitive operations and user data from misuse.

Are sensitive business flows (payments, account deletion, bulk data operations) protected from scripting or automation abuse?

E.g., rate limits, step-up authentication, CAPTCHA, or anomaly detection on high-risk actions.

Yes

Is mass assignment prevented — clients cannot set fields like `isAdmin`, `role`, or `balance` via the request body?

Use explicit allow-lists of assignable fields rather than binding the full request payload to a model.

Yes

Has the API been tested for privilege escalation — a regular user reaching admin or elevated functionality?

Yes