API6:2023 — Unrestricted Access to Sensitive Business Flows

Slide 4 · API6 vs. API4

Infrastructure harm vs. business harm. Different threat. Different fix.

Both involve high-volume API calls. The damage lands in completely different places.

API4 — Unrestricted Resource Consumption

The server is the victim

Goal: exhaust CPU, memory, DB, bandwidth, or third-party cost

Effect: service goes down for everyone

Fix: rate limits, size caps, timeouts

Attacker: usually wants to disrupt or cost-bomb

Example: count=999999 crashes the server

API6 — Business Flow Abuse

The business (and real users) are the victims

Goal: gain unfair advantage, extract value, or manipulate outcomes

Effect: real users can’t buy tickets, prices distorted, platform trust eroded

Fix: business rules, quantity limits, bot detection, verification gates

Attacker: usually wants profit (resale, fraud) or manipulation

Example: bots hold all inventory — server is fine, fans get nothing

They can co-occur

An API4 attack might take a service down. An API6 attack might leave the server perfectly healthy while every real user is effectively excluded from a business flow. API4 is measured in server metrics. API6 is measured in business outcomes — revenue lost, inventory monopolized, trust destroyed.

← Back Why does this keep happening? →