API Security Checklist: 20 Checks Mapped to the OWASP API Top 10

An API security checklist is a list of the controls every API should have in place, from an up-to-date inventory to server-side authorisation checks and rate limits. This API security testing checklist has 20 checks, each tagged to its category in the OWASP API Security Top 10 (2023), so your developers can review an API before release and between penetration tests. You can copy the table below or download the checklist as a spreadsheet (.xlsx, free) to track status, owners and evidence.

API penetration testing is the manual, authorised test that checks whether those controls hold up under attack. A tester works through the API as different users and roles to find the authorisation, authentication, data exposure and business logic flaws that automated scanners miss; our API penetration testing services page explains how we scope and run one.

Key takeaways

• The OWASP API Security Top 10 (2023) is the standard baseline for an API security checklist.
• The most damaging API flaws are authorisation and business logic issues, which scanners cannot see.
• A checklist confirms controls exist; a penetration test confirms they work under attack.
• APIs need testing in their own right; a web front-end test does not cover every endpoint behind it.
• Any API that handles cardholder data, or can affect its security, is in PCI DSS scope.

API security checklist: best practices to check before every release

Use this checklist to review an API before release or between penetration tests. Each item is a best practice your developers should be able to show is in place, tagged with the OWASP API Security Top 10 (2023) risk it prevents.

Items marked “General” cover injection and insufficient logging, which were categories in the 2019 edition of the list but not the 2023 one. They are still baseline controls. The spreadsheet version adds status, owner and evidence columns, so you can attach it to a release or a pen test scope.

How does the checklist map to the OWASP API Security Top 10?

Each risk in the OWASP API Security Top 10 (2023) has a checklist control your developers can review and a check a penetration tester runs to prove the control works:

What does an API pen test add to a checklist?

A checklist shows that controls exist. Scanning finds known weaknesses quickly. A penetration test shows whether the controls hold when someone actively tries to get round them:

Scanning still has a place for routine hygiene. Our comparison of penetration testing vs vulnerability scanning explains how the two fit together.

Why do APIs need their own penetration test?

Because the API, not the user interface, is where access decisions are actually enforced. Modern applications are often thin front ends on top of APIs, and mobile apps and partners talk to those APIs directly. If the API trusts whatever the client sends, a well-formed, authenticated request can quietly return someone else’s data.

Two problems come up repeatedly:

• Forgotten endpoints. Old API versions, debug routes and internal endpoints exposed by mistake often lack the controls applied to the current production API.
• Authorisation that trusts the client. If the API returns a record because the request included its ID, without checking the caller is entitled to it, any logged-in user may be able to read other users’ records.

Firewalls and web application firewalls rarely stop these issues, because nothing about the request looks malicious.

How is an API penetration test run?

1. Scoping. Agree the APIs, environments, user roles, and any endpoints to exclude or rate-limit.
2. Preparation. You provide documentation (OpenAPI or Postman collections) and at least two test accounts per role, so testers can check one user against another.
3. Testing. Manual testing supported by tooling, with immediate notification of anything critical.
4. Reporting. An executive summary for management, and technical findings with evidence, risk ratings and specific fixes. Our guide to reading a penetration testing report shows what good looks like.
5. Retesting. Once fixes are deployed, they are verified and the report is updated.

If your APIs sit behind a customer-facing site, it is usually efficient to scope web application penetration testing in the same engagement. For mobile apps, see our mobile app security testing checklist.

Do PCI DSS and ISO 27001 require API testing?

Neither names APIs specifically, but both catch them.

For payment APIs, PCI penetration testing should be scoped so the report stands up at your assessment.

How much does API penetration testing cost?

Cost follows the number of tester-days, which depends on the number of endpoints, user roles, authentication methods and how complex the business logic is. Documentation and test accounts reduce the days needed, because testers do not have to rebuild your API map. Our guide to penetration testing cost shows typical UK ranges and what drives them.

Why Sovereign Secure

Sovereign Secure is a PCI SSC Qualified Security Assessor (QSA) company, an IASME-licensed Cyber Essentials certification body and ISO 27001 certified. Where an API sits in PCI DSS scope, we scope the test with the assessor’s evidence requirements in mind. Where source code is available, a source code review alongside testing gives the deepest coverage.

Next step

To have your APIs tested against this checklist, see how we scope and run API penetration testing for REST, GraphQL and SOAP. If you already know your endpoints and roles, our penetration testing quote form gets you a fixed price.