The OWASP API Security Top 10 is a risk taxonomy for the most important classes of API weaknesses defenders should test. It groups common failure modes such as broken object level authorization, broken function level authorization, weak authentication, and excessive data exposure. The goal is not to describe every bug, but to help teams focus on the flaws that most often turn APIs into data leaks or control channels.
In practice, the Top 10 is used as a checklist for security reviews, scanners, and authenticated testing. A defender may compare two user identities, probe hidden endpoints, or verify that one account cannot read or change another account’s objects. It matters because many API attacks are authorization failures rather than network exploits: the request is valid, but the business rule is wrong. Mapping tests to the Top 10 helps teams find those problems before attackers do.