Innomerc Choose your depth. Learn at your own pace.
Understand it
API security means allowing the right callers to do the right things with the right data, while keeping the service available. A request can be well-formed and come from a signed-in user yet still ask for something that user should not receive.
In Cedar’s profile API, a user may read their own profile but should not change an administrative role. The API must decide which objects and fields are accessible rather than saving every field the client sends.
Under the hood
OWASP API Security Top 10:2023 separates object authorization, authentication, object-property authorization and function authorization. It also addresses resource consumption, sensitive business flows, SSRF, configuration, inventory and unsafe consumption of other APIs. These are risk categories, not a complete testing checklist.
Enforce schema and business validation, limit returned fields and scope reads and writes to trusted identity. Rate limits should reflect expensive operations and business abuse, not only total requests. Pagination without a maximum still permits excessive work.
Practitioner perspective
Maintain an inventory of routes, versions, consumers and data owners. Deprecated endpoints can preserve old weaknesses after a newer version is secured. Treat partner API responses as untrusted input and apply limits, validation and timeouts.
Test read and write permissions across users, roles and tenants. Monitor denied actions, unusual automation, cost spikes and downstream failures. A gateway helps with shared policy but does not replace object- and property-level application decisions.
Watch it work
A fictional, simplified model. Select a component to inspect it, or follow the steps in order.
Explore the system
Profile update
The client sends a display name and an administrative role field.
Read every step without animation
Unrestricted property update
- Profile update. The client sends a display name and an administrative role field.
- Blind binding. The application copies all supplied properties into the user record.
- Privilege changed. An unauthorized property affects the account.
Object access alone is not property authorization.
Explicit write policy
- Profile update. The same fields reach the server.
- Allowed properties. The server permits only the display-name update for this caller.
- Role unchanged. The privileged field is rejected under policy.
Validate what a caller may change, not only which object they may reach.
Attack view
A fictional client adds a role field to a profile update. The secure path accepts only explicitly permitted properties and refuses the attempted privilege change.
Defender view
- Authorize objects, properties and functions independently.
- Apply input and output schemas, bounded pagination and resource limits.
- Inventory versions and validate responses from third-party APIs.
Common mistakes
- A valid API key does not establish every user permission.
- CORS is a browser policy, not server-side API authorization.
Check your understanding
Active recall: explain this idea in 30 seconds
API security means allowing the right callers to do the right things with the right data, while keeping the service available. A request can be well-formed and come from a signed-in user yet still ask for something that user should not receive.
Now give an example and name one limitation. Revisit the explanation if you get stuck.
Primary sources
Original explanations informed by these specifications and official resources. Source versions and lesson review are separate from product updates.
Content reviewed 2026-09-10. Framework reference: OWASP API Security Top 10 2023. Read the editorial policy.