“APIs tend to expose endpoints that handle business flows. Automated threats can harm the business if API traffic is not properly controlled. The threat is not necessarily a technical vulnerability — it results from the automation of business processes that were designed for human interaction.”
• Business flows accessible without controls that distinguish human from automated clients.
• No per-user limits on how many times a sensitive action can be performed (buy, reserve, register, vote).
• No detection of machine-speed completion of multi-step flows designed for human interaction.
• No inventory reservation timeouts that prevent carts from being held indefinitely.
• No verification requirements (CAPTCHA, phone, email) before high-value actions.
API6 is a new category in the 2023 OWASP API Top 10 — it was not in the 2019 list. OWASP added it because bot-driven business logic abuse has grown dramatically and represents a distinct threat class from simple rate limiting (API4). The harm is measured in business impact, not server load.