OWASP API Top 10 Test-Case Pack
Positive and negative API test cases for every OWASP API Security Top 10 (2023) risk, ready to adapt to your endpoints
What's inside:
For: AppSec engineers, QA engineers, developers
Get your free copy
Enter your email and we'll send the download link to your inbox.
Preview: OWASP API Top 10 Test-Case Pack
This page shows roughly the first 20% of the pack so you can judge it before you download. The full ZIP contains 3 files: owasp-api-top-10-test-cases.csv, owasp-api-top-10-test-cases-guide.pdf, owasp-api-top-10-test-cases-guide.md.
Why positive and negative cases per risk
A security control can fail in two directions. It can let an attack through, or it can block legitimate users and get switched off by the next frustrated team. Each risk in this pack therefore has at least one positive case (the legitimate request still works) and several negative cases (the attack is refused).
The risk names and numbering follow the OWASP API Security Top 10, 2023 edition, published by the OWASP Foundation at owasp.org/API-Security. Read the official descriptions alongside this pack; the cases here are test designs, not a substitute for the project text.
Cases per risk
| OWASP risk | Positive | Negative |
|---|---|---|
| API1:2023 Broken Object Level Authorization | 1 | 5 |
| API2:2023 Broken Authentication | 1 | 7 |
| API3:2023 Broken Object Property Level Authorization | 1 | 4 |
| API4:2023 Unrestricted Resource Consumption | 1 | 6 |
| API5:2023 Broken Function Level Authorization | 1 | 4 |
| API6:2023 Unrestricted Access to Sensitive Business Flows | 1 | 5 |
| API7:2023 Server Side Request Forgery | 1 | 5 |
| API8:2023 Security Misconfiguration | 1 | 5 |
| API9:2023 Improper Inventory Management | 1 | 4 |
| API10:2023 Unsafe Consumption of APIs | 1 | 5 |
OWASP API Security Top 10 (2023) test cases
owasp-api-top-10-test-cases.csv · showing 12 of 60 rows. Positive and negative cases for API1 to API10.
API1-01
Owner can read their own object
- OWASP Risk
- API1:2023 Broken Object Level Authorization
- Preconditions
- User A owns order O1
- Input / Request
- User A: GET /orders/{O1}
- Expected Result
- 200; body is O1
- Type
- Positive
- Priority
- P1
API1-02
Other user cannot read the object
- OWASP Risk
- API1:2023 Broken Object Level Authorization
- Preconditions
- User A owns O1; user B is in the same tenant
- Input / Request
- User B: GET /orders/{O1}
- Expected Result
- 403 or 404; no O1 fields in the body
- Type
- Negative
- Priority
- P1
API1-03
Other user cannot update or delete the object
- OWASP Risk
- API1:2023 Broken Object Level Authorization
- Preconditions
- User A owns O1
- Input / Request
- User B: PATCH /orders/{O1} and DELETE /orders/{O1}
- Expected Result
- 403 or 404; O1 unchanged when re-read by A
- Type
- Negative
- Priority
- P1
API1-04
Cross-tenant read is refused
- OWASP Risk
- API1:2023 Broken Object Level Authorization
- Preconditions
- Tenant T1 user; object in tenant T2
- Input / Request
- T1 user: GET /orders/{T2 object id}
- Expected Result
- 403 or 404
- Type
- Negative
- Priority
- P1
API1-05
Object id in the body or query is checked too
- OWASP Risk
- API1:2023 Broken Object Level Authorization
- Preconditions
- Endpoint takes an id outside the path
- Input / Request
- User B: POST /orders/lookup {"orderId":"{O1}"} and GET /invoices?orderId={O1}
- Expected Result
- No data from O1
- Type
- Negative
- Priority
- P1
API1-06
Neighbouring and guessed ids do not leak data
- OWASP Risk
- API1:2023 Broken Object Level Authorization
- Preconditions
- Sequential or predictable ids
- Input / Request
- User B: GET /orders/{O1+1}, {O1-1} for ids B does not own
- Expected Result
- 403 or 404 for all; no differences that reveal existence beyond the documented behaviour
- Type
- Negative
- Priority
- P2
API2-01
Valid credential is accepted
- OWASP Risk
- API2:2023 Broken Authentication
- Preconditions
- Valid token
- Input / Request
- GET /me with Authorization: Bearer {token}
- Expected Result
- 200
- Type
- Positive
- Priority
- P1
API2-02
No credential is refused on a protected operation
- OWASP Risk
- API2:2023 Broken Authentication
- Preconditions
- -
- Input / Request
- GET /me without Authorization
- Expected Result
- 401
- Type
- Negative
- Priority
- P1
API2-03
Expired, tampered and alg:none tokens are refused
- OWASP Risk
- API2:2023 Broken Authentication
- Preconditions
- Expired token; token with altered payload; token with alg "none"
- Input / Request
- GET /me with each
- Expected Result
- 401 for each
- Type
- Negative
- Priority
- P1
API2-04
Wrong audience or issuer is refused
- OWASP Risk
- API2:2023 Broken Authentication
- Preconditions
- Token for another API; token from another issuer
- Input / Request
- GET /me with each
- Expected Result
- 401
- Type
- Negative
- Priority
- P1
API2-05
Brute force on login is limited
- OWASP Risk
- API2:2023 Broken Authentication
- Preconditions
- Lockout or throttle policy
- Input / Request
- Repeated POST /auth/login with wrong passwords
- Expected Result
- Lockout, delay or 429 after the policy threshold
- Type
- Negative
- Priority
- P1
API2-06
Credential stuffing defences on password reset and OTP
- OWASP Risk
- API2:2023 Broken Authentication
- Preconditions
- -
- Input / Request
- Repeated POST /auth/password-reset and /auth/otp/verify
- Expected Result
- 429 or lockout after the threshold; OTP cannot be brute-forced
- Type
- Negative
- Priority
- P1
The rest of the pack
60 rows across the CSV file, and all 8 sections of the guide as PDF and Markdown. Enter your work email above and we will send the download link.
Want to automate your API testing?
Generate tests from OpenAPI specs, run in CI/CD, and scale quality across teams.