API Security Checklist

Authorization weaknesses across object, function, and property scopes — the OWASP API Security Top 10 (2023) access-control failures (API1, API3, API5).

Authentication and credential weaknesses for APIs — broken authentication (API2:2023) and insecure API key / token lifecycle management.

Protocol-level testing for REST and GraphQL APIs, including verb handling, content negotiation, CORS, introspection, and query-cost abuse.

Resource consumption, SSRF, inventory, and configuration hardening — OWASP API Top 10 (2023) risks API4, API7, API8, and API9.

API6:2023 sensitive business-flow abuse and concurrency-driven logic flaws unique to programmatic, high-throughput API access.