Checklist · Security
API Security Checklist
Opens with creditsAn API security checklist you can run against a real codebase before a release. It is built on the OWASP API Security Top 10 (2023 edition) and the OWASP cheat sheets, and every check says how much it matters and exactly how to verify it.
Written by Tauseef Fayyaz7 chapters, 35 checksAbout 15 minReviewed 12 October 2026What you will learn
7 chapters · about 15 min
1AuthenticationChecks that every request proves who is calling, and that tokens and login flows cannot be abused (OWASP API2:2023).5 checks · 2 min
- 1Every non-public endpoint rejects requests without valid credentials
- 2JWTs are verified for signature, algorithm, issuer, audience and expiry
- 3Login, OTP and password reset endpoints are rate limited
- 4Tokens, API keys and passwords never travel in URLs
- 5Access tokens are short-lived and can be revoked
5 in this chapterOpen this chapter2Object, property and function level authorizationChecks that a logged-in user can only reach their own objects, fields and functions (OWASP API1, API3 and API5:2023).5 checks · 2 min
- 1Every request for an object checks the caller may access that object (BOLA)
- 2Unguessable IDs are used, but never as the only protection
- 3Create and update endpoints accept only an allowlist of fields (mass assignment)
- 4Responses include only the fields the caller is allowed to see
- 5Admin and privileged functions check the caller role on the server
5 in this chapterOpen this chapter- Rate limiting and resource limitsChecks that no single client can exhaust your servers, your database or your bill (OWASP API4 and API6:2023).5 checks · 2 minOpens with credits
- Input validation, injection and SSRFChecks that every input is validated on the server and that URL-fetching features cannot be pointed at your internal network (OWASP API7 and API10:2023).6 checks · 3 minOpens with credits
- TLS, CORS and security headersChecks on how the API is reached: encrypted transport, which origins may call it from a browser, and the headers that go with each response.4 checks · 2 minOpens with credits
- Error handling, logging and monitoringChecks that errors tell attackers nothing useful, and that your logs tell you when something is wrong.5 checks · 2 minOpens with credits
- Inventory, versioning and configurationChecks that you know every API host and version you run, and that none of them are left with debug settings or open admin access (OWASP API8 and API9:2023).5 checks · 2 minOpens with credits
About this checklist
This API security checklist turns the OWASP API Security Top 10 into checks you can actually run. APIs fail in predictable ways: an endpoint returns another user's order when you change the ID, a signup form lets you set isAdmin: true, a login endpoint accepts a million password guesses, or an "import from URL" feature fetches the cloud metadata service. Each of these is on the OWASP list, and each can be tested in minutes.
The first two chapters cover authentication and authorization, because broken object level authorization (BOLA) and broken authentication are the top two risks in the 2023 edition and the ones most often found in real APIs. Later chapters cover rate limits and resource limits, input validation and server-side request forgery (SSRF), TLS and CORS, error handling and logging, and keeping an inventory of every API version you run.
Each check has a severity. Must means fix it before you ship; should means fix it soon; nice means it is worth doing once the rest is solid. Every check also tells you how to verify it, usually with a request you can send with curl or your API client using two test accounts.
Common questions
What is the OWASP API Security Top 10?
It is OWASP's list of the most critical security risks specific to APIs. The current edition is from 2023 and starts with broken object level authorization, broken authentication and broken object property level authorization. It also covers resource consumption, function level authorization, business flows, SSRF, misconfiguration, inventory and unsafe consumption of APIs.
What is BOLA in API security?
Broken object level authorization (BOLA) is when an API lets a user access an object just by changing its ID, without checking that the user owns it. You test for it with two accounts: request one account's objects while logged in as the other. Every such request should be refused.
How do I test my API for security issues?
Start with two test accounts and an API client such as curl or Postman. Work through this checklist: missing authentication, cross-account access, extra fields on updates, oversized requests, rate limits, SSRF on URL inputs and error messages. Automate the checks that matter most so they run on every release.
What is the difference between 401 and 403?
401 Unauthorized means the request has no valid authentication, so the client should log in or refresh its token. 403 Forbidden means the caller is authenticated but not allowed to do this. Using them consistently makes clients and monitoring behave correctly.
Is rate limiting enough to protect an API?
No. Rate limiting stops floods and slows brute force, but it does nothing about a single request that reads another user's data or sets a forbidden field. You need authorization checks, input validation and rate limits together.
Should I use a wildcard in CORS for my API?
Only for truly public, read-only APIs that do not use cookies or credentials. For anything with logged-in users, list the exact origins you trust and never reflect the request's Origin header back blindly.
Sources (6)
Checked against these, last on 12 October 2026.
- OWASP Top 10 API Security Risks 2023, OWASPapi-security.owasp.org/editions/2023/en/0x11-t10/
- API3:2023 Broken Object Property Level Authorization, OWASPapi-security.owasp.org/editions/2023/en/0xa3-broken-object-property-level-authorization/
- API4:2023 Unrestricted Resource Consumption, OWASPapi-security.owasp.org/editions/2023/en/0xa4-unrestricted-resource-consumption/
- API9:2023 Improper Inventory Management, OWASPapi-security.owasp.org/editions/2023/en/0xa9-improper-inventory-management/
- REST Security Cheat Sheet, OWASPcheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html
- Server Side Request Forgery Prevention Cheat Sheet, OWASPcheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
Related on Sefism
Picked from the other libraries by shared topics.
Roadmaps
See allCheat sheets
See allBest practices
See all- Authentication Best PracticesBuild sign-in that holds up: password rules from NIST, Argon2id hashing, login throttling, MFA and passkeys, secure sessions and safe account recovery.
- Secure Coding Best PracticesWrite code that resists attack: untrusted input, validation, parameterized queries, output encoding, safe parsing, uploads, SSRF and errors that fail closed.
- Authorization Best PracticesGet access control right: deny by default, object-level checks against IDOR, RBAC vs ABAC vs ReBAC, tenant isolation with row-level security, audits and tests.
Checklists
See all- Web Application Security ChecklistA practical web application security checklist built on the OWASP Top 10:2025 and ASVS 5.0, with a severity and a way to verify every check.
- Linux Server Hardening ChecklistHarden an Ubuntu, Debian or RHEL server step by step: accounts and sudo, SSH, updates, firewall and open ports, permissions, logging and CIS benchmark scans.
- Software Supply Chain Security ChecklistCheck your dependencies and builds before a release: lockfiles, update bots, pinned actions, CI permissions, SLSA provenance, Sigstore signing, SBOMs and a plan for a compromised package.
Project structures
See all- Firebase (Cloud Functions and security rules) project structureFor students building an app on Firebase who need a real backend: Cloud Functions (2nd gen) in TypeScript, Firestore and Storage security rules with tests, and the Local Emulator Suite. The tree starts from
firebase initand grows into feature folders of callables, triggers and scheduled jobs, then adds CI deploys, environments, contract tests and runbooks. - AI agent with an MCP server project structureFor developers who want to give AI assistants safe access to their own data or API. A TypeScript MCP server built on the official SDK, organised by feature (tasks, projects) with each feature owning its tools, resources and prompts, served over stdio for local hosts and Streamable HTTP with OAuth for remote ones, plus a small agent and the evals that prove a model can use it.
- Terraform project structureAn infrastructure repository for a small app on AWS: reusable modules, one folder per environment with its own remote state, pinned providers, tests and security scans, with plan on every pull request and apply from CI. For students who have finished the Terraform tutorials and want to know how a real team lays out the files. The same layout works unchanged with OpenTofu.
Career questions
See all- How do I get into AI security as a student or junior engineer?Build a normal security or software foundation first, then learn how LLM apps fail using the OWASP Top 10 for LLM Applications and MITRE ATLAS, and prove it by building, testing and hardening a small LLM app of your own. Most people reach AI security through AppSec, security engineering or ML engineering, not straight from university.
- Where do I start if I want a career in cybersecurity or IT operations?Start with the foundations both fields share: networking, Linux, and how systems fail. Then choose an entry role such as SOC analyst, IT support or junior cloud operations, and prove it with hands-on labs and one documented project rather than a stack of certificates.
- Can I use AI coding tools at my internship, and what should I never paste into them?Usually yes, but only the tools your company has approved, on the code and data they allow, and in the way they allow. Ask in your first week. Never paste secrets, customer data or code you are not permitted to share, and review everything the tool writes as if your name is on it, because it is.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com