☑️Introduction

APIs are mostly seen in web but its not just for the web. It helps making communications between different systems seamless. APIs create a consistent structure for how requests must be sent to the server for processing, and how the server responds to the requests.

APIs are broadly categorized as either public, accessible to external parties, or private, restricted to specific organizations or groups of systems.

API Styles

Web APIs can be built using various architectural styles, including REST, SOAP, GraphQL, and gRPC, each with its own strengths and use cases:

• Representational State Transfer (REST) is the most popular API style. It uses a client-server model where clients make requests to resources on a server using standard HTTP methods (GET, POST, PUT, DELETE). RESTful APIs are stateless, meaning each request contains all necessary information for the server to process it, and responses are typically serialized as JSON or XML.

• Simple Object Access Protocol (SOAP) uses XML for message exchange between systems. SOAP APIs are highly standardized and offer comprehensive features for security, transactions, and error handling, but they are generally more complex to implement and use than RESTful APIs.

• GraphQL is an alternative style that provides a more flexible and efficient way to fetch and update data. Instead of returning a fixed set of fields for each resource, GraphQL allows clients to specify exactly what data they need, reducing over-fetching and under-fetching of data. GraphQL APIs use a single endpoint and a strongly-typed query language to retrieve data.

• gRPC is a newer style that uses Protocol Buffers for message serialization, providing a high-performance, efficient way to communicate between systems. gRPC APIs can be developed in a variety of programming languages and are particularly useful for microservices and distributed systems.

OWASP Top 10 API Security Risks

API1:2023 - Broken Object Level Authorization	The API allows authenticated users to access data they are not authorized to view.
API2:2023 - Broken Authentication	The authentication mechanisms of the API can be bypassed or circumvented, allowing unauthorized access.
API3:2023 - Broken Object Property Level Authorization	The API reveals sensitive data to authorized users that they should not access or permits them to manipulate sensitive properties.
API4:2023 - Unrestricted Resource Consumption	The API does not limit the amount of resources users can consume.
API5:2023 - Broken Function Level Authorization	The API allows unauthorized users to perform authorized operations.
API6:2023 - Unrestricted Access to Sensitive Business Flows	The API exposes sensitive business flows, leading to potential financial losses and other damages.
API7:2023 - Server Side Request Forgery	The API does not validate requests adequately, allowing attackers to send malicious requests and interact with internal resources.
API8:2023 - Security Misconfiguration	The API suffers from security misconfigurations, including vulnerabilities that lead to Injection Attacks.
API9:2023 - Improper Inventory Management	The API does not properly and securely manage version inventory.
API10:2023 - Unsafe Consumption of APIs	The API consumes another API unsafely, leading to potential security risks.