{
  "node_id": "owasp-api-top-10-2023-api06-unrestricted-access-to-sensitive-business-flows",
  "title": "API6:2023 Unrestricted Access to Sensitive Business Flows",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2023-06-13",
  "bluf": "OWASP API Security Top 10 (2023) API6:2023 Unrestricted Access to Sensitive Business Flows. When creating an API Endpoint, it is important to understand which business flow it exposes. Some business flows are more sensitive than others, in the sense that excessive access to them may harm the business. Common examples of sensitive business flows and risk of excessive access associated with them: * Purchasing a product flow - an attacker can buy all the stock of a high-demand item at once and resell for a higher price (scalping) * Creating a comment/post flow - an attacker can spam the system * Making a reservation - an attacker can reserve all the available time slots and prevent other users from using the system The risk of excessive access might change between industries and businesses. For example - creation of posts by a script might be considered as a risk of spam by one social network, but encouraged by another social network. An API Endpoint is vulnerable if it exposes a sensitive business flow, without appropriately restricting the access to it. This category sits within the OWASP API Security Top 10 (2023 edition), the canonical industry list of the ten most critical API security risks. Organizations implementing API services should treat each of the ten categories as both a design constraint and a continuous-monitoring obligation, with policies, automated testing, and incident response procedures defined per category.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "ai_overlay_2026"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "owasp-asvs-l1",
    "owasp-asvs-l2",
    "nist-sp-800-53-r5",
    "iso-27001-2022"
  ],
  "primary_citations_count": 9
}