{
  "node_id": "owasp-api-top-10-2023-api09-improper-inventory-management",
  "title": "API9:2023 Improper Inventory Management",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2023-06-13",
  "bluf": "OWASP API Security Top 10 (2023) API9:2023 Improper Inventory Management. The sprawled and connected nature of APIs and modern applications brings new challenges. It is important for organizations not only to have a good understanding and visibility of their own APIs and API endpoints, but also how the APIs are storing or sharing data with external third parties. Running multiple versions of an API requires additional management resources from the API provider and expands the attack surface. An API has a \"<ins>documentation blindspot</ins>\" if: * The purpose of an API host is unclear, and there are no explicit answers to the following questions * Which environment is the API running in (e.g. production, staging, test, development)? * Who should have network access to the API (e.g. public, internal, partners)? * Which API version is running? * There is no documentation or the existing documentation is not updated. * There is no retirement plan for each API version. * The host's inventory is missing or outdated. The visibility and inventory of sensitive data flows play an important role as part of an incident response plan, in case a breach happens on the third party side. An API has a \"<ins>data flow blindspot</ins>\" if: * There is a \"sensitive data flow\"... This category sits within the OWASP API Security Top 10 (2023 edition), the canonical industry list of the ten most critical API security risks. Organizations implementing API services should treat each of the ten categories as both a design constraint and a continuous-monitoring obligation, with policies, automated testing, and incident response procedures defined per category.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "ai_overlay_2026"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "owasp-asvs-l1",
    "owasp-asvs-l2",
    "nist-sp-800-53-r5",
    "iso-27001-2022"
  ],
  "primary_citations_count": 12
}