API Security Testing Guide: OWASP API Top 10 for SaaS and Fintech

APIs are the core of modern SaaS — and also the easiest place to leak data or lose accounts.
This guide explains the most practical API risks (OWASP-style) and what teams can do this week to reduce exposure.

---

1) Broken Object Level Authorization (BOLA / IDOR)

What it looks like
Changing resource_id=123 to 124 reveals someone else’s data.

How to test

• Try sequential IDs, UUID swaps, and “guessable” IDs
• Verify access control on every object endpoint

Fix

• Enforce authorization checks server-side per object
• Prefer opaque identifiers
• Add automated authorization tests in CI

---

2) Broken Authentication

What it looks like
Weak session handling, missing MFA paths, insecure reset flows, token leakage.

How to test

• Password reset flow abuse
• Token reuse and refresh handling
• Session invalidation after logout/password change

Fix

• Short-lived access tokens + secure refresh token patterns
• Strong rate limiting on auth endpoints
• MFA for privileged accounts

---

3) Broken Object Property Level Authorization

What it looks like
A user can modify fields they shouldn’t (e.g., role=admin, plan=premium, isVerified=true).

How to test

• Add extra JSON properties to update endpoints
• Observe whether server ignores, accepts, or partially applies changes

Fix

• Allowlist fields on the server
• Validate input schemas strictly
• Separate admin endpoints from user endpoints

---

4) Unrestricted Resource Consumption

What it looks like
DoS-by-design: no rate limits, expensive queries, large payloads, infinite pagination.

Fix

• Rate limit per identity + IP
• Enforce payload size limits
• Pagination with caps
• Timeouts and query complexity control

---

5) Broken Function Level Authorization (BFLA)

What it looks like
Users can call admin-only endpoints (or internal functions) because the route is exposed.

Fix

• Authorize by function/role at the endpoint level
• Separate admin routes
• Remove debug/admin routes in production

---

6) Unrestricted Access to Sensitive Business Flows

What it looks like
Abuse of business logic: brute forcing promo codes, mass account creation, invoice manipulation, trial abuse.

Fix

• Behavioral controls (velocity checks)
• Idempotency and strong server-side validations
• Fraud signals + anomaly detection on key flows

---

7) Server-Side Request Forgery (SSRF)

What it looks like
The API fetches URLs (webhooks, importers, preview services) and can be abused to reach internal networks.

Fix

• Strict allowlists for outbound domains
• Block private IP ranges and metadata endpoints
• Use safe network egress controls and dedicated fetch services

---

8) Security Misconfiguration

What it looks like
Verbose errors, default configs, debug mode, permissive CORS, missing TLS headers.

Fix

• Harden configs
• Reduce error leakage
• Set secure defaults and enforce them in CI/CD

---

9) Improper Inventory Management

What it looks like
Unknown endpoints, forgotten versions (/v1, /v2), shadow APIs, stale documentation.

Fix

• Maintain API inventory
• Remove deprecated endpoints
• Gate deployments with API schema checks
• Use automated discovery in staging

---

10) Unsafe Consumption of APIs

What it looks like
Your system trusts third-party APIs too much (webhooks, integrations), leading to injection or spoofing.

Fix

• Validate inputs from external APIs
• Verify signatures for webhooks
• Use strict schema checks and allowlists

---

“What should I fix first?” (SaaS priority order)

If you can only do 5 things this month:

1. Fix IDOR/BOLA on all object endpoints
2. Add rate limiting + abuse controls on auth & critical flows
3. Lock down property-level updates (allowlist fields)
4. Enforce strict authZ by function/role (admin endpoints)
5. Create a real API inventory and remove stale versions

---

What a good API pentest deliverable looks like

A useful report should include:

• impacted endpoints
• clear reproduction steps
• business impact
• severity + prioritization
• remediation guidance your engineers can implement quickly
• retest criteria

For dedicated API Security Testing (REST and GraphQL, OWASP-aligned), see the service page. For Web Application Penetration Testing and report examples, see Services and Reports.