{
  "node_id": "owasp-api-top-10-2023-api03-broken-object-property-level-authorization",
  "title": "API3:2023 Broken Object Property Level Authorization",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2023-06-13",
  "bluf": "OWASP API Security Top 10 (2023) API3:2023 Broken Object Property Level Authorization. When allowing a user to access an object using an API endpoint, it is important to validate that the user has access to the specific object properties they are trying to access. An API endpoint is vulnerable if: * The API endpoint exposes properties of an object that are considered sensitive and should not be read by the user. (previously named: \"[Excessive Data Exposure][1]\") * The API endpoint allows a user to change, add/or delete the value of a sensitive object's property which the user should not be able to access (previously named: \"[Mass Assignment][2]\") This category sits within the OWASP API Security Top 10 (2023 edition), the canonical industry list of the ten most critical API security risks. Organizations implementing API services should treat each of the ten categories as both a design constraint and a continuous-monitoring obligation, with policies, automated testing, and incident response procedures defined per category.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "ai_overlay_2026"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "owasp-asvs-l1",
    "owasp-asvs-l2",
    "nist-sp-800-53-r5",
    "iso-27001-2022"
  ],
  "primary_citations_count": 12
}