API6:2023 — Unrestricted Access to Sensitive Business Flows

Slide 2 · The Word

Unrestricted Access to Sensitive Business Flows.

The API works perfectly. The business logic never said “stop.”

What “sensitive business flows” means

A business flow is any multi-step process your API enables: checkout, ticket purchase, account registration, referral redemption, review submission, appointment booking, vote casting.

A flow becomes “sensitive” when automating it at scale creates unfair outcomes — revenue loss, inventory monopolization, market manipulation, or platform integrity failures.

Flows that become dangerous at machine speed

Ticket purchase — bots hold all inventory

Checkout — bots clear limited-edition releases

Account creation — bots farm referral bonuses

Review submission — bots bomb competitor ratings

Appointment booking — bots monopolize slots

Poll/vote — bots manipulate outcomes

Promo code redemption — bots brute-force codes

What makes them sensitive

Scarce inventory — each bot purchase excludes a real buyer

Financial value — resale arbitrage profit motive

Platform fairness — real users experience the harm

Reward systems — each fraudulent action has a monetary cost

Trust signals — fake reviews undermine platform credibility

The core problem

The API doesn’t have a bug. The endpoints work as designed. The business logic simply never defined upper bounds on how many times a single actor can participate in a flow — or how fast they can complete it.

← Back See the official definition →