Slide 2 · Definition
Unsafe Consumption of APIs — trusting third-party responses like internal data.
Developers apply strict validation to user input. They apply almost none to responses from APIs they integrate with. Attackers exploit that asymmetry.
One-sentence definition
Unsafe Consumption of APIs occurs when an API consumes data from third-party services — payment processors, geolocation services, identity providers, CDN-hosted scripts — and treats those responses as inherently trustworthy, skipping the input validation, output encoding, and security controls it would apply to user-submitted data.
Validated for type, length, format
Sanitized before SQL queries (parameterized)
Escaped before HTML rendering
Checked against allowlists
Logged with care for injection
Assumed to be correctly typed and formatted
Inserted into SQL queries unsanitized
Rendered to HTML without escaping
Followed as redirects without validation
Logged directly — including any JNDI strings
The trust assumption is the vulnerability
The security model breaks when a third-party service is compromised, returns unexpected data, or is impersonated by an attacker. At that point, malicious data enters the system through a path that was deliberately exempted from validation — because developers assumed third-party responses were safe. API10 is the risk created by that assumption.