Checklist · API security
Check every API you expose, and who can call it
The API checks I run in assessments, aligned with the OWASP API Security Top 10 2023. Start with the inventory and object-level authorisation: that is where the most damaging flaws sit.
- 20 checks
- 6 critical
- Saved in your browser
- 0/20
- checks ticked
- 0/6
- critical checks
Inventory
0/5Authentication and authorisation
0/6Input and traffic controls
0/5Monitoring and testing
0/4Go deeper
When a checklist is not enough.
A checklist tells you what is missing. An assessment tells you what it means, what to fix first and what it will cost.
- WAAP & API protection assessmentI review your WAF, WAAP, bot and API controls against your real estate and traffic, then show the gaps, the bypass paths and a safe route to blocking.2–4 weeksFixed fee
- Application architecture reviewI take one application or platform and trace every path from the internet to its data, then show which controls hold, which are missing and what to fix first.1–3 weeksFixed fee
- API securityThe worst API attacks look like valid requests. I check what you expose, what the edge can enforce and what only your code can fix.Expertise · Area 02
- Edge & WAAPI have onboarded more than 230 applications to WAAP across two programmes. I check what your edge really blocks, what gets around it and how to reach blocking safely.Expertise · Area 01
Can a WAAP or API gateway stop broken object level authorisation?
Usually not on its own. Broken object level authorisation (BOLA) is a logic flaw: a logged-in user changes an ID and receives someone else’s data, and the request looks entirely valid. A WAAP (web application and API protection) platform or gateway can enforce schemas, limit rates and flag unusual enumeration, which helps. The fix is in the code: check on every request that the caller may access that specific object.
What is the OWASP API Security Top 10 2023?
It is an awareness list from OWASP (the Open Worldwide Application Security Project) of the ten most critical API (application programming interface) security risks. The 2023 edition starts with broken object level authorisation and also covers broken authentication, unrestricted resource consumption, server-side request forgery and improper inventory management. Use it as a lens for design reviews and testing, not as a compliance certificate.
How do I find shadow APIs?
Compare three views. First, the endpoints your WAAP (web application and API protection) platform or API gateway sees in live traffic. Second, the specifications and code repositories your development teams maintain. Third, the calls your mobile app and partner integrations actually make. Anything in traffic but missing from the inventory is a shadow API. Old versions still answering in production are a frequent find.