API Security.

API security covers REST, GraphQL, gRPC and webhook surfaces that often expose business logic directly. It maps to the OWASP API Security Top 10 (2023), which ranks Broken Object Level Authorization (BOLA/API1) first, followed by Broken Authentication, Broken Object Property Level Authorization, Unrestricted Resource Consumption, Broken Function Level Authorization, and Server-Side Request Forgery.

Why BOLA dominates. Most API breaches are not exotic — they are missing per-object ownership checks. In the September 2022 Optus breach, an internet-facing endpoint required no authentication and exposed customer records addressable by sequential IDs, letting an attacker enumerate roughly 10 million Australians. In January 2023, T-Mobile disclosed abuse of an API that authenticated the session but did not scope which records that session could read, exposing about 37 million accounts. Both are textbook object-level authorization failures.

Controls. Effective programmes combine strong identity (OAuth 2.0 / OIDC, short-lived scoped tokens, mTLS), a server-side ownership check on every object reference, schema-driven request and response validation, rate limiting and quotas to blunt scraping, and structured logging feeding a SIEM. Continuous testing through SAST, DAST and API-specific fuzzing catches regressions. Discovery and inventory of shadow and zombie APIs are foundational, because you cannot defend endpoints you do not know exist.

flowchart TD
  A[Client request + bearer token] --> B{Valid token?}
  B -->|No| R[401 Unauthorized]
  B -->|Yes| C{Token scope allows this operation?}
  C -->|No| F[403 Forbidden]
  C -->|Yes| D{Does caller OWN this object ID?}
  D -->|No - BOLA risk| F
  D -->|Yes| E{Within rate limit and schema valid?}
  E -->|No| G[429 / 400 rejected]
  E -->|Yes| H[Return only permitted fields]