🔒 Security · APIs · REST · GraphQL
Learn the API Top 10
by actually doing it.
An interactive, slide-by-slide breakdown of the top 10 API security risks. You don't need to write code to understand why APIs break.
API1Live
Broken Object Level Auth
Accessing other users' data by changing an ID in a request.
Start →
API2Live
Broken Authentication
Weak tokens, no rate limiting, and credential stuffing attacks.
Start →
API3Live
Broken Object Property Auth
Changing fields you shouldn't be able to touch — like your own role.
Start →
API4Live
Unrestricted Resource Consumption
No rate limits — attackers drain resources, inflate costs, or take the service down.
Start →
API5Live
Broken Function Level Auth
Calling admin actions as a regular user because the API never checked your role.
Start →
API6Live
Unrestricted Access to Business Flows
Bots monopolize ticket inventory and drain referral programs — the API works fine, real users just can't get in.
Start →
API7Live
Server Side Request Forgery
One URL parameter hits the cloud metadata endpoint and hands over IAM credentials. Capital One learned this the hard way.
Start →
API8Live
Security Misconfiguration
The right code, the wrong settings. CORS that trusts everyone, debug mode in production, and admin panels with no password.
Start →
API9Live
Improper Inventory Management
Forgotten v1 endpoints still running in production long after v2 launched. The security patch in v2 means nothing if v1 still answers.
Start →
API10Live
Unsafe Consumption of APIs
Ticketmaster trusted a third-party script. That script stole 40,000 payment cards. Security controls stop at the user boundary — they must extend to everything you consume.
Start →