Slide 3 of 28
Part 1 · What Is It?Slide 3
Slide 3 · The Definition
What OWASP says.
Automation. Business harm. No traditional vulnerability.
📄 OWASP API Security Top 10 · 2023 · API6
The OWASP Definition

“APIs tend to expose endpoints that handle business flows. Automated threats can harm the business if API traffic is not properly controlled. The threat is not necessarily a technical vulnerability — it results from the automation of business processes that were designed for human interaction.”

What makes an API vulnerable

• Business flows accessible without controls that distinguish human from automated clients.

• No per-user limits on how many times a sensitive action can be performed (buy, reserve, register, vote).

• No detection of machine-speed completion of multi-step flows designed for human interaction.

• No inventory reservation timeouts that prevent carts from being held indefinitely.

• No verification requirements (CAPTCHA, phone, email) before high-value actions.

New in the 2023 edition

API6 is a new category in the 2023 OWASP API Top 10 — it was not in the 2019 list. OWASP added it because bot-driven business logic abuse has grown dramatically and represents a distinct threat class from simple rate limiting (API4). The harm is measured in business impact, not server load.

← Back How is this different from API4? →