{
  "node_id": "owasp-api-top-10-2023-api04-unrestricted-resource-consumption",
  "title": "API4:2023 Unrestricted Resource Consumption",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2023-06-13",
  "bluf": "OWASP API Security Top 10 (2023) API4:2023 Unrestricted Resource Consumption. Satisfying API requests requires resources such as network bandwidth, CPU, memory, and storage. Sometimes required resources are made available by service providers via API integrations, and paid for per request, such as sending emails/SMS/phone calls, biometrics validation, etc. An API is vulnerable if at least one of the following limits is missing or set inappropriately (e.g. too low/high): * Execution timeouts * Maximum allocable memory * Maximum number of file descriptors * Maximum number of processes * Maximum upload file size * Number of operations to perform in a single API client request (e.g. GraphQL batching) * Number of records per page to return in a single request-response * Third-party service providers' spending limit This category sits within the OWASP API Security Top 10 (2023 edition), the canonical industry list of the ten most critical API security risks. Organizations implementing API services should treat each of the ten categories as both a design constraint and a continuous-monitoring obligation, with policies, automated testing, and incident response procedures defined per category.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "ai_overlay_2026"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "owasp-asvs-l1",
    "owasp-asvs-l2",
    "nist-sp-800-53-r5",
    "iso-27001-2022"
  ],
  "primary_citations_count": 12
}