Skip to main content
API Security

API Penetration Testing to the OWASP API Security Top 10

APIs now carry most application traffic — and most of the data. The OWASP API Security Top 10 lists the risks attackers exploit most, led by broken object level authorisation: changing an ID in a request to read someone else’s data.

Mutex Systems tests REST, GraphQL and mobile-backend APIs against every category, using your API specification so no endpoint is missed.

Request a ConsultationAll Frameworks & Standards
Category
Testing Methodology
Jurisdiction
International
Issuing Body
OWASP Foundation
Current Version
OWASP API Security Top 10 — 2023 edition (released June 2023)
Who It's For
SaaS providers, fintechs, open-banking and payment providers, and any business exposing APIs to partners, mobile apps or the public.
Read the official source
What It Covers

Core Domains

API1 Broken Object Level Authorization
API2 Broken Authentication
API3 Broken Object Property Level Authorization
API4 Unrestricted Resource Consumption
API5 Broken Function Level Authorization
API6 Unrestricted Access to Sensitive Business Flows
API7 Server-Side Request Forgery
API8 Security Misconfiguration
API9 Improper Inventory Management
API10 Unsafe Consumption of APIs
How It Works

A Practical Engagement Path

  1. 01

    Inventory

    Collect OpenAPI/GraphQL specifications and find undocumented endpoints.

  2. 02

    Authorisation testing

    Test every endpoint with every role for object- and function-level access flaws.

  3. 03

    Abuse testing

    Rate limits, resource consumption and business-flow abuse.

  4. 04

    Report & retest

    Findings mapped to API Top 10 categories with fixes and a retest.

Our Approach

Specification-driven, role-by-role testing

Authorisation flaws only appear when each endpoint is tested as each user, so we build a role matrix before testing.

  • REST, GraphQL and gRPC
  • Undocumented and shadow endpoint discovery
  • Open-banking and payment API experience
View Cybersecurity Services

Related Pages

Compliance, Continuously

API scanning between pen tests

grComply’s Web apps & APIs posture area tests running APIs from their specification and keeps findings mapped to your frameworks until they are fixed.

  • Findings from code, web app, API, cloud, Kubernetes and network scans in one findings list
  • Each finding mapped to its technical benchmark and to the controls of every framework you hold
  • High-risk findings raised straight into the risk register with an owner and due date
  • Retest results recorded as evidence, so auditors see the fix, not just the finding

grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.

See How grComply Works
FAQs

Common Questions About OWASP API Top 10

What is BOLA?

Broken Object Level Authorization: the API does not check that the user may access the specific record they request, so changing an ID exposes other users’ data. It is the most common serious API flaw.

Do you test GraphQL APIs?

Yes, including introspection exposure, query depth and batching abuse, and field-level authorisation.

What do you need to test an API?

An API specification if available, test accounts for each role, and a test or staging environment. We can also work from traffic captured from your app.

Let's Talk

Ready to Start Your OWASP API Top 10 Programme?

Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.

No commitment requiredResponse within 2 working daysConfidential brief handling
Request a ConsultationView Client Portfolio