OWASP API Security Project | OWASP Foundation (original) (raw)

What is API Security?

A foundational element of innovation in today’s app-driven world is the API. From banks, retail and transportation to IoT, autonomous vehicles and smart cities, APIs are a critical part of modern mobile, SaaS and web applications and can be found in customer-facing, partner-facing and internal applications. By nature, APIs expose application logic and sensitive data such as Personally Identifiable Information (PII) and because of this have increasingly become a target for attackers. Without secure APIs, rapid innovation would be impossible.

API Security focuses on strategies and solutions to understand and mitigate the unique vulnerabilities and security risks of Application Programming Interfaces (APIs).

API Security Top 10 2023

Here is a sneak peek of the 2023 version:

Licensing

The OWASP API Security Project documents are free to use!

The OWASP API Security Project is licensed under the Creative Commons Attribution-ShareAlike 4.0 license, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

Founders

Leaders

Cequence Security

Checkmarx

Equixly

Impart Security

Salt Security

Traceable

2023 Contributors

247arjun, abunuwas, Alissa Knight, Arik Atar, aymenfurter, Corey J. Ball, cyn8, d0znpp, Dan Gordon, donge, Dor Tumarkin, faizzaidi, gavjl, guybensimhon, Inês Martins, Isabelle Mauny, Ivan Novikov, jmanico, Juan Pablo, k7jto, LaurentCB, llegaz, Maxim Zavodchik, MrPRogers, planetlevel, rahulk22, Roey Eliyahu, Roshan Piyush, securitylevelup, sudeshgadewar123, Tatsuya-hasegawa, tebbers, vanderaj, wenz, xplo1t-sec, Yaniv Balmas, ynvb

2019 Contributors

007divyachawla, Abid Khan, Adam Fisher, anotherik, bkimminich, caseysoftware, Chris Westphal, dsopas, DSotnikov, emilva, ErezYalon, flascelles, Guillaume Benats, IgorSasovets, Inonshk, JonnySchnittger, jmanico, jmdx, Keith Casey, kozmic, LauraRosePorter, Matthieu Estrade, nathanawmk, PauloASilva, pentagramz, philippederyck, pleothaud, r00ter, Raj kumar, Sagar Popat, Stephen Gates, thomaskonrad, xycloops123, Raphael Hagi, Eduardo Bellis, Bruno Barbosa

Google Group

Join the discussion on the OWASP API Security Project Google group.

This is the best place to introduce yourself, ask questions, suggest and discuss any topic that is relevant to the project.

GitHub Discussions

You can also use GitHub Discussions as a place to connect with other community members, asking questions or sharing ideas.

GitHub

The project is maintained in the OWASP API Security Project repo.

The latest changes are under the develop branch.

Feel free to open or solve an issue.

Ready to contribute directly into the repo? Great! Just make sure you read theHow to Contribute guide.

Planned Projects

Roadmap

Roadmap

OWASP API Security Top 10 2023

OWASP API Security Top 10 2019