APIs Are the New Perimeter
In India's API-first economy — UPI, Account Aggregator, ONDC, Open Banking — APIs handle the most sensitive data flows. And they are under relentless attack.
68%Indian APIs vulnerable to BOLA (Broken Object Level Authorization) (Salt Security API Report 2025)
681%Increase in API attacks globally in 2024-2025 (Salt Security)
₹5.2 CrAverage cost of an API-related breach in India (IBM 2025)
Common gapMany Indian organisations never test their APIs — despite APIs being the most-attacked surface in modern apps
OWASP API Security Top 10 (2023) — Explained for Indian Developers
1. Broken Object Level Authorization (BOLA)
The #1 API vulnerability. An attacker changes an ID in the request to access another user's data.
bash
# Legitimate request
GET /api/users/12345/transactions
# Attacker changes ID to access victim's data
GET /api/users/12346/transactions
# If this returns data — you have BOLADANGER
BOLA is responsible for 40% of all API breaches. Indian fintech APIs are especially vulnerable because many use sequential IDs and lack object-level authorization checks.
2. Broken Authentication
| Vulnerability | Example | Fix |
|---|---|---|
| No rate limiting on login | Brute force passwords | Implement progressive rate limiting |
| Token never expires | Stolen token works forever | Set JWT expiry (15 min for access) |
| Weak password policy | "password123" accepted | Enforce complexity + breach checks |
| No MFA | Single-factor authentication | Add TOTP/SMS MFA |
3. Broken Object Property Level Authorization
APIs returning more data than the user should see:
json
// What the API returns
{
"name": "Rahul Sharma",
"email": "rahul@company.com",
"pan": "ABCDE1234F",
"aadhaar": "1234-5678-9012",
"salary": 1500000,
"bankAccount": "12345678901234"
}
// What the user should see
{
"name": "Rahul Sharma",
"email": "rahul@company.com"
}4. Unrestricted Resource Consumption
No rate limiting, no pagination limits, no file size limits.
| Check | What to Test | Expected Behaviour |
|---|---|---|
| Rate limiting | Send 1000 requests/second | Returns 429 after threshold |
| Pagination | Request page_size=1000000 | Caps at reasonable limit (50-100) |
| File upload | Upload 1GB file | Rejects above limit (e.g., 10MB) |
| Query complexity | Deep nested GraphQL query | Rejects above depth limit |
5. Broken Function Level Authorization
Regular users accessing admin endpoints:
bash
# Regular user calling admin endpoint
POST /api/admin/users/create
# Should return 403 — but 23% of Indian APIs allow this6-10. Other Critical Vulnerabilities
| # | Vulnerability | Risk | Indian Context |
|---|---|---|---|
| 6 | Server-Side Request Forgery (SSRF) | High | Cloud metadata endpoint exposure |
| 7 | Security Misconfiguration | High | Debug mode in production |
| 8 | Lack of Protection from Automated Threats | High | Scraping, credential stuffing |
| 9 | Improper Asset Management | Medium | Undocumented legacy APIs still active |
| 10 | Unsafe Consumption of APIs | Medium | Trusting third-party API responses |
API Security Testing Methodology
graph TD
A[📋 API Discovery
Find all endpoints] --> B[🔍 Schema Analysis
Test input validation] B --> C[🔐 Auth Testing
BOLA, broken auth] C --> D[💉 Injection Testing
SQLi, NoSQLi, XSS] D --> E[🚦 Rate Limit Testing
Abuse scenarios] E --> F[📊 Report
OWASP-mapped findings] style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style C fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style F fill:#1e5f3a,stroke:#10B981,color:#e2e8f0
Find all endpoints] --> B[🔍 Schema Analysis
Test input validation] B --> C[🔐 Auth Testing
BOLA, broken auth] C --> D[💉 Injection Testing
SQLi, NoSQLi, XSS] D --> E[🚦 Rate Limit Testing
Abuse scenarios] E --> F[📊 Report
OWASP-mapped findings] style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style C fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style F fill:#1e5f3a,stroke:#10B981,color:#e2e8f0
Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanBuilding API Security Into Your Development Process
Pre-commit checks
- Schema validation for all inputs (use Zod, Joi, or Yup)
- Authentication middleware on every route
- Authorization checks at the object level, not just the endpoint level
CI/CD integration
- Automated API security scans in your pipeline
- OWASP ZAP or similar tools for every PR
- Dependency vulnerability scanning (npm audit, Snyk)
Production monitoring
- API anomaly detection (unusual patterns, volume spikes)
- Real-time alerting for auth failures
- API access logging with request/response bodies (for critical endpoints)
Key Takeaway
API security is not a one-time test — it's a continuous practice. Every new endpoint, every schema change, every third-party integration introduces potential vulnerabilities. Build security into your development workflow with automated testing, quarterly VAPT scans, and continuous monitoring.
Get Your APIs Tested
INFO
Bachao.AI's VAPT scans include comprehensive API security testing covering the OWASP API Top 10. Book a free scan to find out how your APIs score.
Written by Shouvik Mukherjee, Founder of Bachao.AI. Follow me on LinkedIn for API security insights and Indian fintech threat intelligence.
