What is API security?
D3 · Architecture · CompTIA Security+ SY0-701API security encompasses the practices and technologies used to protect APIs (Application Programming Interfaces) from attacks, abuse, and unauthorized access. APIs are increasingly the primary attack surface for modern applications.
Common API vulnerabilities (OWASP API Security Top 10):
🔑 Broken Object Level Authorization (BOLA) — accessing other users' data by manipulating IDs
🔐 Broken Authentication — weak API key management, no rate limiting
📊 Excessive Data Exposure — API returns more data than the client needs
💥 Mass Assignment — API allows setting properties that shouldn't be user-controllable
Common API vulnerabilities (OWASP API Security Top 10):
🔑 Broken Object Level Authorization (BOLA) — accessing other users' data by manipulating IDs
🔐 Broken Authentication — weak API key management, no rate limiting
📊 Excessive Data Exposure — API returns more data than the client needs
💥 Mass Assignment — API allows setting properties that shouldn't be user-controllable
APIs are the new perimeter. Common protections: authentication (OAuth/API keys), rate limiting (prevent abuse/DoS), input validation, TLS encryption, API gateway (centralized security enforcement), logging/monitoring. BOLA (also called IDOR — Insecure Direct Object Reference) is the most common API vulnerability.