// appsec · 6 min

API Security Testing: The Attack Surface Everyone Forgets

Your mobile app, your single-page frontend, your partner integrations — they all talk to APIs. Attackers know this. The OWASP API Security Top 10 exists because APIs fail in ways web-page testing never catches.

Why APIs are different

A web app renders pages; an API exposes raw operations. Testers have to reason about object ownership, authorisation on every endpoint, and data returned that the UI would normally hide. A scanner clicking through pages sees almost none of this.

The failures that dominate

• Broken object-level authorisation (BOLA) — change an ID in the request, get someone else's data. The single most common API breach.
• Broken function-level authorisation — call an admin endpoint as a normal user because the UI just hid the button.
• Excessive data exposure — the API returns full objects and trusts the client to hide fields. It doesn't.
• Unrestricted resource consumption — no rate limits, no pagination caps, trivial denial of service.

How proper API testing works

Authenticated testing across multiple roles and tenants, replaying and mutating real requests, checking authorisation on every single endpoint — not just the ones the UI calls. Mapped to the OWASP API Security Top 10, with evidence for each finding. If your last "pentest" only clicked through the website, your API was never tested.