API Security
Training
Break real API endpoints the way an attacker does, then ship the authorization check that stops them.
10 hands-on exercises across the OWASP API Security Top 10. Free to play, no sign-up required.
OWASP Top 10 for API Security
Broken Function Level Authorization
Call staff-only endpoints from a read-only account.
- Reach admin routes as an analyst
- Pull a roster and queue a payout
- Add a router-level role guard
Broken Object Level Authorization
Swap an id and read another rider.
- Change the object id in a request
- Harvest records by walking ids
- Enforce per-object ownership
Broken User Authentication
Brute-force a six-digit login code.
- Attack an unlimited verify endpoint
- Take over with only an email
- Rate-limit per account with 429
Excessive Data Exposure
Read the fields the UI never shows.
- Compare rendered page to raw JSON
- Find phone, birth date, coordinates
- Serialize a field allow-list
Improper Inventory Management
Read records through a retired API version.
- Swap v2 for a deprecated v1
- Bypass controls the new version enforces
- Retire old versions with 410 Gone
Injection
Turn a search box into a full database read.
- Break out of a catalog query
- UNION-dump the users table
- Parameterize so input stays data
Insufficient Logging & Monitoring
Look up a customer and leave no trace.
- Access a record with no ticket
- See why no one can attribute it
- Add audit records and alerts
Mass Assignment
Mint a loyalty balance with two extra keys.
- Add fields to a PATCH body
- Write attributes you should not own
- Bind only editable fields
Security Misconfiguration
Read a signed-in account from any website.
- Reflect an arbitrary CORS origin
- Weaponize a lure page
- Lock CORS to an allow-list
Unrestricted Resource Consumption
Scrape a catalog with one oversized request.
- Set page size from the request
- Pull 250,000 records at once
- Cap page size server-side
Frequently Asked Questions
What is API security training?
API security training teaches developers and engineers to find the authorization and data-exposure flaws specific to APIs, where there is no user interface to hide behind and every endpoint is directly reachable.
These exercises follow the OWASP API Security Top 10, the list maintained specifically for API risks rather than general web application risks.
How is API security different from web application security?
APIs fail differently. The most common API bugs are authorization flaws such as Broken Object Level Authorization, where the server checks that you are logged in but never that the record belongs to you.
APIs also leak through over-serialization: the interface shows a name and city while the JSON response carries phone numbers, birth dates, and coordinates. Those failures have no equivalent in a rendered page.
What does BOLA mean?
BOLA stands for Broken Object Level Authorization, the number one risk on the OWASP API Security Top 10. It happens when an endpoint accepts an object id from the request and returns that object without verifying the caller owns it.
In practice, changing one digit in a request returns another customer’s record, and sequential ids let an attacker harvest the entire dataset.
Are these API security exercises free?
Yes. Every exercise runs in your browser with no sign-up required.
Enterprise features such as completion analytics, SCORM and LTI packaging for your LMS, SSO, and custom content are available on paid plans.
See RansomLeak in Action
Try the free exercises or book a demo to see analytics, SCORM export, SSO, and custom content in your environment.