For most SaaS products the API is the product, and attackers know it. Salt Security's 2025 State of API Security Report found that 99% of surveyed organisations had API security issues in the previous 12 months, and 95% of API attacks came from authenticated users. This guide maps the OWASP API Security Top 10 to the controls a small team can build without a dedicated security department.
Why authenticated users are the main API risk
Many teams treat login as the security boundary: once a request carries a valid token, it is trusted. Salt's data shows why that is not enough. If 95% of attacks come from authenticated users, the real question for each endpoint is not whether the caller is logged in but whether this caller may act on this specific object. This is also why API flaws often slip past scanners. A request that reads another tenant's record looks syntactically perfect. Only business rules, written into your code and tests, can tell the difference.
The OWASP API Security Top 10 (2023) for SaaS
OWASP's API list was last refreshed in 2023 and remains the reference most buyers ask about. The table translates each item into what it usually looks like in a SaaS codebase, with the first control worth building. Several of these, notably API1, API3 and API5, are authorisation problems, which is why they rarely show up in automated scans and need tests written around your own business rules.
| Risk | What it looks like in SaaS | First control to build |
|---|---|---|
| API1 Broken Object Level Authorization | Changing an ID returns another tenant's record | Ownership check on every object lookup |
| API2 Broken Authentication | Weak tokens, long-lived keys, no MFA for admins | Standard OAuth or OIDC flows, short token lifetimes |
| API3 Broken Object Property Level Authorization | Response leaks fields, or client can set 'role' | Explicit response schemas and allowlisted writable fields |
| API4 Unrestricted Resource Consumption | Unlimited exports, SMS or email triggers | Rate limits, pagination and quotas |
| API5 Broken Function Level Authorization | Normal user calls an admin endpoint | Role checks on every route, deny by default |
| API6 Unrestricted Access to Sensitive Business Flows | Bots abuse sign-up, coupons or bookings | Per-flow limits and abuse monitoring |
| API7 Server Side Request Forgery | Webhook or URL import fetches internal addresses | URL allowlists and egress controls |
| API8 Security Misconfiguration | Verbose errors, open CORS, default settings | Hardened gateway and framework config |
| API9 Improper Inventory Management | Old v1 endpoints and debug routes still live | Single API spec as source of truth |
| API10 Unsafe Consumption of APIs | Trusting data from partner or third-party APIs | Validate and limit third-party responses |
Fixing object-level authorisation properly
BOLA is first on the OWASP API list, and in multi-tenant SaaS it is the flaw most likely to cause a reportable breach. The durable fix is architectural: scope every database query by tenant and user at the data-access layer, so a developer cannot forget the check in a single handler.
Back it with tests. For each resource type, create two tenants in your test suite and assert that tenant A receives a not-found or forbidden response for every one of tenant B's IDs. Random, non-sequential IDs make enumeration harder, but they are not a substitute for the check.
Authentication, tokens and keys
Use a well-supported identity provider or framework rather than writing token handling yourself. Curity's guidance on the OWASP list recommends going beyond simple API keys, using OAuth flows for users and mutual TLS or sender-constrained tokens for machine clients where the risk justifies it.
Keys deserve special care because they leak. GitGuardian's 2025 report found MongoDB credentials were the most common secret leaked in public repositories, at 18.8% of cases. Give customer API keys scopes and expiry dates, show only a prefix after creation, and let customers rotate them without a support ticket.
Rate limits and business-flow protection
Every request costs something: compute, database load, or a paid SMS or email. API4 and API6 are about stopping one caller from consuming far more than intended, whether through a script that exports everything or a bot farming free trials. Apply limits per token and per IP at the gateway, and stricter limits on login, password reset, invitations and any endpoint that sends messages. For business flows, ask what an attacker would gain by automating each step. Limits on resource creation over a time window and a step-up check for unusual volumes usually stop the abuse without hurting real users.
Inventory, versioning and third-party APIs
You cannot protect an endpoint you have forgotten. Salt found that 58% of organisations monitor APIs less than daily and lack confidence in their inventory. Keep an OpenAPI specification in the repository, generate documentation from it, and fail the build when a route exists in code but not in the spec. Set a retirement date for every old version. API10 reverses the usual view: your service is the consumer. Treat responses from payment, CRM or messaging partners as untrusted input. Validate their shape, cap their size, set timeouts and never pass their data straight into queries.
Logging and testing APIs on a small team
A small team can cover most API risk with a short, repeatable routine rather than an expensive platform. The checklist below fits into normal sprint work. The OWASP Logging Cheat Sheet recommends recording authorisation failures and suspicious business logic, such as actions that exceed limits, and those events are the raw material for most of the alerts listed here.
- Log every authorisation failure with user, tenant, endpoint and object ID
- Alert on one user hitting many distinct object IDs in a short window
- Run cross-tenant authorisation tests in CI for every new endpoint
- Review the API spec diff in every pull request
- Test webhooks and URL imports against internal address ranges
- Book an authorised external API test before major enterprise launches
Where to start this quarter
If you only do three things, make them tenant-scoped data access, rate limits on sensitive endpoints, and an accurate API inventory. Together they address the categories most often behind real SaaS incidents. IBM's 2025 study found breaches detected internally cost about USD 900,000 less than those disclosed by an attacker, which is a strong argument for the logging step too. XDQ Labs builds and tests SaaS APIs for teams in India, the US, the UAE and the UK, and the same checklist applies whatever the stack.
Frequently asked questions
What is the most common API vulnerability?
Broken Object Level Authorization (BOLA) is first on the OWASP API Security Top 10 2023. It happens when an endpoint accepts an object ID and returns or changes that object without checking the caller is allowed to access it. In multi-tenant SaaS it can expose one customer's data to another.
Is an API gateway enough for API security?
No. A gateway helps with authentication, rate limits and configuration, but it cannot know whether a user owns a specific record. Object and function level authorisation must be enforced in your application code and data layer, and tested automatically.
How often should a small SaaS team test its APIs?
Automated authorisation and schema tests should run on every pull request. A deeper manual or external test makes sense before major launches, enterprise security reviews or big architecture changes. Logging and alerting give continuous coverage between tests.
What is unsafe consumption of APIs?
It is API10 in the OWASP 2023 list. It describes trusting data from third-party or partner APIs more than user input. If a partner is compromised or returns unexpected data, your service can be attacked through it. Validate, size-limit and time-limit every third-party response.
Sources
- OWASP API Security Project: API Security Top 10 2023, OWASP Foundation, 2023
- Top 10 API Security Vulnerabilities According to OWASP, Curity, 2024
- 99% of Organizations Report API-Related Security Issues, Infosecurity Magazine, 2025
- Verizon 2025 Data Breach Investigations Report: news release, Verizon, 2025
- The State of Secrets Sprawl 2025, GitGuardian, 2025
- Average global data breach cost now $4.44 million (IBM Cost of a Data Breach Report 2025), Help Net Security, 2025
- Logging Cheat Sheet, OWASP Cheat Sheet Series, 2025
- OWASP Top 10:2025 Introduction, OWASP Foundation, 2025
