OWASP API Security Tools
Free OWASP API Top 10 tools: audit authentication coverage, detect excessive data exposure, scan for mass assignment risk, and check security misconfiguration. By Graph Tools.
- Authentication Coverage Auditor — Analyze OpenAPI security schemes and operation-level requirements to find endpoints missing authentication
- Excessive Data Exposure Detector — Compare API response samples against OpenAPI schemas to detect extra undeclared sensitive fields that should not be in responses
- Mass Assignment Risk Detector — Scan OpenAPI request schemas for writable role, admin, permission, status, and tenant fields that create mass assignment risk
- Rate Limit Hint Detector — Inspect HTTP response headers for rate-limit signals and warn when standards-based headers like RateLimit or X-RateLimit are absent
- BOLA Risk Indicator (Static) — Perform static analysis on API paths and parameters to highlight where object-level authorization checks should exist
- Improper Asset Management Detector — Analyze OpenAPI specs for unused tags, unmarked deprecated endpoints, and inconsistent server URLs that signal asset management problems
- Security Misconfiguration Indicator — Check OpenAPI specs and samples for debug endpoints, overly broad CORS, missing error schemas, and inconsistent auth patterns
- Injection Pattern Pre-Scanner — Scan API payloads for suspicious SQL fragments, unescaped templates, and query patterns that suggest injection risk