APIs are the soft underbelly of modern software. Your web app may have a hardened front door, but its API — built for machines, documented for partners, and often forgotten by security reviews — exposes the same data through a side entrance. The OWASP API Security Top 10 exists because API breaches kept following patterns that traditional web checklists missed.

Here are the failure classes that matter most, with the BOLA pattern that tops the list and the controls that actually stop it.

Why Traditional WAFs Fail with APIs

Traditional Web Application Firewalls inspect HTTP requests for known malicious strings (like ' OR '1'='1). But modern API vulnerabilities are flaws in business logic, not invalid character strings.

BOLA (Broken Object Level Authorization) — The #1 Killer

BOLA occurs when an endpoint accepts an object ID directly from the user request and fails to verify whether the logged-in user owns that object.

GET /api/v1/invoices/10492 HTTP/1.1
Host: api.target.com
Authorization: Bearer <Victim_Token>

If an attacker simply changes 10492 to 10493 and receives another customer's financial details, that is classic BOLA.

Practical Mitigations for API Gateways

  • Enforce Context-Aware Authorization: Validate that the token subject has an explicit relationship with the requested resource in the database.
  • Rate Limiting & Cost Analysis: Set strict rate limits per IP and API key to prevent mass scraping.
  • Schema Validation: Reject requests with unexpected properties to prevent Mass Assignment vulnerabilities.

Broken Function Level Authorization and Mass Assignment

Two cousins of BOLA round out the classic API failures. Broken Function Level Authorization lets ordinary users invoke admin functions — a DELETE /api/users/42 endpoint that checks "is logged in" but never "is an admin". Broken Object Property Level Authorization (mass assignment) lets attackers add fields the API never meant to accept: submit {"role": "admin"} in a profile update and a careless ORM happily writes it. Both are one-line oversights with total-compromise consequences, and both appear constantly in real bug-bounty reports.

Excessive Data Exposure: The Silent Leak

Many APIs return entire database objects and trust the frontend to hide the sensitive fields. Attackers do not use your frontend — they read the raw JSON, complete with internal IDs, password-reset tokens, precise geolocation, and other users' data. The fix is response shaping: serialize exactly the fields each client needs, per endpoint, and test the raw responses, not the rendered UI.

A Practical API Security Checklist

  • Inventory every API endpoint, including shadow and legacy versions.
  • Test authorization per object and per function with two accounts at different privilege levels.
  • Apply schema validation on requests and responses.
  • Rate-limit by key and identity; alert on enumeration patterns.
  • Log API traffic centrally — you cannot investigate what you never recorded.

Testing BOLA Yourself (In a Lab)

The fastest way to internalize BOLA is to commit it — against a deliberately vulnerable lab API, never a production system. Create two accounts, A and B. As A, create an object (an order, an invoice, a document) and note its ID. Authenticate as B and request A's object ID directly. If the API returns it, you have reproduced the most damaging bug class in modern web security in under five minutes. Then apply the fix in the lab: derive ownership from the token on every request, and re-test. Frameworks and training platforms (including the labs in our web-security courses) exist precisely for this loop. One hour of committing and fixing BOLA teaches more than a week of reading about it — and it is the exact test professional API pentesters run first.

Key Takeaways

  • API flaws are business-logic flaws; signature-based WAFs barely see them.
  • BOLA — swapping an object ID — remains the most damaging API bug class.
  • Authorization must be checked per object, per property, and per function.
  • Test with two real accounts and raw responses, not the polished UI.