Reference Registry — API Security

Purpose

This note is the API-security-specific seed for the broader cybersecurity reference registry.

Use it to: - standardize references for API-security notes - keep source quality consistent - help Codex assign references without inventing weak source sets - make future API-security notes easier to expand

Source of truth rule

For API-security notes, this registry is the primary source of truth.

Use it together with: - <a href="api-security/index.html">API Security Index</a> for study order and branch structure - <a href="reference-registry.html">Cybersecurity Reference Registry</a> for broader fallback only when this note does not yet cover an API-security topic

Reference selection policy

Source priority

official standards and project documentation
official labs and practical training
testing guides and cheat sheets
high-signal research
secondary sources only when they add clear value

Per-note target

minimum 2 references
ideal 3 references
avoid bloating notes with long lists

Labeling

Use: - Foundational - Testing / Lab - Research / Deep Dive - Official Tool Docs

API-security topic map

api-security-top-10

Preferred references: - Foundational: OWASP API Security Top 10 2023 — https://owasp.org/API-Security/editions/2023/en/0x00-header/ - Foundational: OWASP API Security Project — https://owasp.org/www-project-api-security/ - Foundational: OWASP REST Security Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html - Testing / Lab: PortSwigger API testing — https://portswigger.net/web-security/api-testing

authorization

Preferred references: - Foundational: OWASP Authorization Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html - Foundational: OWASP API Security Project — https://owasp.org/www-project-api-security/ - Testing / Lab: PortSwigger access control — https://portswigger.net/web-security/access-control

broken-object-level-authorization

Preferred references: - Foundational: OWASP API1:2023 Broken Object Level Authorization — https://owasp.org/API-Security/editions/2023/en/0xa1-bola/ - Foundational: OWASP API Security Project — https://owasp.org/www-project-api-security/ - Testing / Lab: PortSwigger access control / IDOR — https://portswigger.net/web-security/access-control/idor

broken-function-level-authorization

Preferred references: - Foundational: OWASP API5:2023 Broken Function Level Authorization — https://owasp.org/API-Security/editions/2023/en/0xa5-bfla/ - Foundational: OWASP Authorization Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html - Testing / Lab: PortSwigger access control — https://portswigger.net/web-security/access-control

broken-authentication

Preferred references: - Foundational: OWASP API2:2023 Broken Authentication — https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/ - Foundational: OWASP Authentication Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html - Testing / Lab: PortSwigger API testing — https://portswigger.net/web-security/api-testing

api-auth-flaws

Preferred references: - Foundational: OWASP Authentication Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html - Foundational: OWASP API2:2023 Broken Authentication — https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/ - Testing / Lab: PortSwigger authentication vulnerabilities — https://portswigger.net/web-security/authentication

jwt-attacks

Preferred references: - Foundational: OWASP Authentication Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html - Foundational: OWASP JSON Web Token for Java Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html - Testing / Lab: PortSwigger JWT attacks topic — https://portswigger.net/web-security/jwt

token-lifecycle

Preferred references: - Foundational: OWASP Authentication Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html - Foundational: OWASP API2:2023 Broken Authentication — https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/ - Foundational: OWASP Cheat Sheet Series — https://cheatsheetseries.owasp.org/

broken-object-property-level-authorization

Preferred references: - Foundational: OWASP API3:2023 Broken Object Property Level Authorization — https://owasp.org/API-Security/editions/2023/en/0xa3-bopla/ - Foundational: OWASP API Security Project — https://owasp.org/www-project-api-security/ - Testing / Lab: OWASP WSTG API testing: excessive data exposure — https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/12-API_Testing/03-Testing_for_Excessive_Data_Exposure

excessive-data-exposure

Preferred references: - Foundational: OWASP WSTG API testing: excessive data exposure — https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/12-API_Testing/03-Testing_for_Excessive_Data_Exposure - Foundational: OWASP API3:2023 Broken Object Property Level Authorization — https://owasp.org/API-Security/editions/2023/en/0xa3-bopla/ - Testing / Lab: PortSwigger API testing — https://portswigger.net/web-security/api-testing

mass-assignment

Preferred references: - Foundational: OWASP API Security Top 10 2023 — https://owasp.org/API-Security/editions/2023/en/0x11-t10/ - Foundational: OWASP API3:2023 Broken Object Property Level Authorization — https://owasp.org/API-Security/editions/2023/en/0xa3-bopla/ - Testing / Lab: PortSwigger API testing — https://portswigger.net/web-security/api-testing

api-rate-limiting

Preferred references: - Foundational: OWASP API4:2023 Unrestricted Resource Consumption — https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/ - Foundational: OWASP API Security Project — https://owasp.org/www-project-api-security/ - Testing / Lab: PortSwigger API testing — https://portswigger.net/web-security/api-testing

api-inventory-management

Preferred references: - Foundational: OWASP API9:2023 Improper Inventory Management — https://owasp.org/API-Security/editions/2023/en/0xa9-improper-inventory-management/ - Foundational: OWASP API Security Project — https://owasp.org/www-project-api-security/ - Testing / Lab: PortSwigger API testing and OWASP alignment — https://portswigger.net/web-security/api-testing/top-10-api-vulnerabilities

polymorphic-deserialization

Preferred references: - Foundational: OWASP Deserialization Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html - Foundational: OWASP API8:2023 Security Misconfiguration — https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/ - Testing / Lab: PortSwigger Exploiting insecure deserialization — https://portswigger.net/web-security/deserialization/exploiting - Research / Deep Dive: Moritz Bechler, "Java Unmarshaller Security" (marshalsec) — https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf - Official Tool Docs: ysoserial.net — https://github.com/pwntester/ysoserial.net

Registry usage rules

choose the smallest set of strongest references for each exact note
do not assign generic links blindly
prefer official documentation and strong labs
if a future API-security note is missing from this registry, map it to the closest parent topic first