API security: object authorization, bounded resources, and trusted integrations

API security enforces identity, object and function authorization, schema and property policy, resource budgets, business-flow controls, egress policy, inventory, and downstream trust at each request boundary.

Security invariants

• API-C1: Object, property, and function authorization are separate server-side checks and all include authoritative tenant and resource context.
• API-C2: API authentication validates the credential profile and replay context before application code and does not place credentials in URLs or logs.
• API-C3: Resource-consumption controls cover payload, concurrency, time, downstream cost, pagination, and quotas, while sensitive business flows need domain abuse controls.
• API-C4: SSRF defenses combine canonical destination validation with DNS, redirect, protocol, address, response, and network egress restrictions.
• API-C5: A complete API inventory records deployed versions, endpoints, owners, data and lifecycle so deprecated and shadow APIs can be removed.
• API-C6: Third-party API responses remain untrusted and require transport identity, deadlines, size and schema limits, and safe parsing.

Trust-boundary map

Component	Responsibility
client	Authorized API Client
attacker	Adversarial or Abusive Client
gateway	API Gateway and Request Boundary
authenticator	Token and Client Authentication
authorizer	Object and Function Authorization
rate-limiter	Resource and Business-Flow Limits
api	Application API
object-store	Tenant-Scoped Object Store
schema-validator	Request and Response Schema Policy
outbound-connector	Allowlisted Outbound Connector
inventory	API Inventory and Lifecycle
audit-log	API Security Audit

Topology edges represent authenticated or otherwise explicit communication paths. Responses reuse those physical paths in reverse; no response-only or bypass edges are added.

Executable scenarios

complete-request-gate — Complete request gate

Authentication, request budget, object and function authorization, schema policy, and audit context all precede the protected operation.

▶Walkthrough: complete-request-gate (not found)

bola-object-authorization — API1 Broken Object Level Authorization

Every endpoint that receives an object identifier binds authorization to authoritative object and tenant state, loaded by the endpoint or authorization service.

▶Walkthrough: bola-object-authorization (not found)

broken-authentication — API2 Broken Authentication

Tokens and client credentials are validated under a fixed profile with throttling and no credential material in URLs or logs.

▶Walkthrough: broken-authentication (not found)

property-level-authorization — API3 Broken Object Property Level Authorization

Read and write property allowlists are role and object specific; generic serialization and mass assignment do not expose internal fields.

▶Walkthrough: property-level-authorization (not found)

resource-consumption — API4 Unrestricted Resource Consumption

Limits cover request size, concurrency, execution time, downstream cost, pagination, uploads, and per-principal quotas rather than requests per second alone.

▶Walkthrough: resource-consumption (not found)

function-level-authorization — API5 Broken Function Level Authorization

Administrative paths and HTTP methods enforce permission at the server, even when the UI hides the feature.

▶Walkthrough: function-level-authorization (not found)

sensitive-business-flow — API6 Unrestricted Access to Sensitive Business Flows

Business actions such as purchases, reservations, or invitations have abuse-resistant limits and state invariants beyond technical authentication.

▶Walkthrough: sensitive-business-flow (not found)

ssrf-egress-policy — API7 Server Side Request Forgery

Server-controlled destination policy parses and resolves URLs, restricts scheme and address ranges, and constrains redirects and egress at the network boundary.

▶Walkthrough: ssrf-egress-policy (not found)

security-misconfiguration — API8 Security Misconfiguration

Production APIs use a hardened repeatable baseline, minimal methods, strict CORS, safe errors, current dependencies, and no default credentials.

▶Walkthrough: security-misconfiguration (not found)

inventory-lifecycle — API9 Improper Inventory Management

Every host, version, endpoint, data classification, owner, dependency, and retirement date is inventoried so shadow or deprecated APIs cannot persist unnoticed.

▶Walkthrough: inventory-lifecycle (not found)

unsafe-api-consumption — API10 Unsafe Consumption of APIs

Responses from third-party APIs are untrusted input: use TLS identity, timeouts, size limits, schema validation, safe redirects, and least-privilege data handling.

▶Walkthrough: unsafe-api-consumption (not found)

Operational and failure rules

• Every rejection path fails closed at the component that owns the decision; infrastructure failure is never converted into authentication, authorization, or integrity success.
• Retries preserve stable transaction identity, replay detection, bounded freshness, and audit context. A retry does not erase a prior success or compromise signal.
• Concurrent validation branches are independent checks. Completion requires every mandatory branch, and no check substitutes for another.
• Logs contain decision metadata and stable identifiers, not credentials, bearer tokens, cryptographic keys, or sensitive payloads.

Related concepts

[CONCEPT]authz-models [CONCEPT]oauth-oidc [CONCEPT]jwt-best-practices [CONCEPT]owasp-top-10

Authoritative sources

1. OWASP API Security Top 10 2023
2. RFC 9700: Best Current Practice for OAuth 2.0 Security
3. OWASP Server Side Request Forgery Prevention Cheat Sheet