{"uid":"cap_JsM9UmotrctxCX-AtfHC9","slug":"openapi-security-audit-owasp-api-top-10-2023-contract-checks-cda7f921","name":"OpenAPI Security Audit — OWASP API Top 10 2023 Contract Checks","description":"An autonomous paid API accepting USDC on Base mainnet.","url":"https://47-85-47-24.sslip.io/v1/openapi-security","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","properties":{"scenario":{"enum":["insecure-admin-contract"],"type":"string","description":"Built-in paid OpenAPI security-review scenario"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["analysis_id","analyzer_version","label","profile","verdict","risk_score","summary","stats","operations","findings","remediation_plan","coverage"],"properties":{"label":{"type":"string"},"stats":{"type":"object"},"profile":{"enum":["internet","internal"],"type":"string"},"summary":{"type":"string"},"verdict":{"enum":["BLOCK","WARN","PASS"],"type":"string"},"coverage":{"type":"object"},"findings":{"type":"array","items":{"type":"object"}},"operations":{"type":"array","items":{"type":"object"}},"risk_score":{"type":"integer","maximum":100,"minimum":0},"analysis_id":{"type":"string"},"analyzer_version":{"type":"string"},"remediation_plan":{"type":"array","items":{"type":"string"}}}}}}}},"responseSchema":{"type":"json","example":{"label":"paid-demo:insecure-admin-contract","stats":{"low":1,"high":5,"medium":2,"critical":0,"findings":8,"operations":2,"security_schemes":1,"write_operations":1,"remote_references":0,"protected_operations":0,"anonymous_or_public_operations":2},"profile":"internet","summary":"BLOCK: 8 finding(s) across 2 operation(s); 5 high, 2 medium, 1 low.","verdict":"BLOCK","coverage":{"rules":["authentication and authorization declarations","security-scheme transport and flow choices","resource bounds for pagination and request bodies","sensitive response and privileged input fields","deployment transport and API inventory hygiene","external reference trust boundaries"],"standard":"OWASP API Security Top 10 2023","local_refs":true,"limitations":"A contract cannot prove runtime authorization, rate limiting, input enforcement, or exploitability; verify findings against implementation and gateway policy.","active_scanning":false,"exploit_attempts":false,"contract_level_only":true,"remote_refs_fetched":false},"findings":[{"code":"api_key_in_query","summary":"An API key is transmitted in the URL query string.","evidence":"Security scheme 'queryKey' uses in=query.","location":"$.components.securitySchemes/queryKey","severity":"high","remediation":"Move credentials to an Authorization or purpose-specific request header.","risk_weight":18,"owasp_api_2023":"API2:2023 Broken Authentication"},{"code":"sensitive_response_without_required_auth","summary":"An unauthenticated success response documents sensitive-looking fields.","evidence":"refresh_token","location":"$.paths//accounts/get/responses","severity":"high","remediation":"Require object/property authorization and remove secrets from response schemas.","risk_weight":20,"owasp_api_2023":"API3:2023 Broken Object Property Level Authorization"},{"code":"write_operation_without_required_auth","summary":"A state-changing operation does not require documented authentication.","evidence":"Effective security mode is anonymous.","location":"$.paths//admin/users/{id}/delete","severity":"high","remediation":"Require an appropriate security scheme and enforce function-level authorization.","risk_weight":22,"owasp_api_2023":"API5:2023 Broken Function Level Authorization"},{"code":"privileged_fields_client_writable","summary":"Potentially privileged properties are client-writable.","evidence":"role","location":"$.paths//admin/users/{id}/delete/requestBody","severity":"high","remediation":"Use allow-listed input DTOs and derive ownership, roles, prices, and status server-side.","risk_weight":17,"owasp_api_2023":"API3:2023 Broken Object Property Level Authorization"},{"code":"insecure_server_transport","summary":"A documented API server uses cleartext HTTP.","evidence":"http://api.example.test","location":"$.servers/0/url","severity":"high","remediation":"Use HTTPS with modern TLS for every non-local deployment.","risk_weight":16,"owasp_api_2023":"API8:2023 Security Misconfiguration"},{"code":"read_operation_without_documented_auth","summary":"A read operation has no mandatory documented authentication.","evidence":"Effective security mode is undocumented.","location":"$.paths//accounts/get","severity":"medium","remediation":"Declare required authentication or list this operation explicitly as intentionally public.","risk_weight":10,"owasp_api_2023":"API2:2023 Broken Authentication"},{"code":"unbounded_pagination_parameter","summary":"A pagination or result-count parameter has no maximum.","evidence":"'limit' is numeric without maximum.","location":"$.paths//accounts/get/parameters/query:limit","severity":"medium","remediation":"Set a conservative schema maximum and enforce the same server-side cap.","risk_weight":7,"owasp_api_2023":"API4:2023 Unrestricted Resource Consumption"},{"code":"security_schemes_unused","summary":"Declared security schemes are not referenced by any operation.","evidence":"queryKey","location":"$.components.securitySchemes","severity":"low","remediation":"Remove stale schemes or attach them to the intended global/operation requirements.","risk_weight":3,"owasp_api_2023":"API9:2023 Improper Inventory Management"}],"operations":[{"path":"/accounts","method":"GET","operation_id":"listAccounts","security_mode":"undocumented","write_operation":false},{"path":"/admin/users/{id}","method":"DELETE","operation_id":"deleteUser","security_mode":"anonymous","write_operation":true}],"risk_score":100,"analysis_id":"apisec-cbfa909ee1a1a22f","analyzer_version":"apisec-openapi-owasp-2023/1.0","remediation_plan":["Move credentials to an Authorization or purpose-specific request header.","Require object/property authorization and remove secrets from response schemas.","Require an appropriate security scheme and enforce function-level authorization.","Use allow-listed input DTOs and derive ownership, roles, prices, and status server-side.","Use HTTPS with modern TLS for every non-local deployment.","Declare required authentication or list this operation explicitly as intentionally public.","Set a conservative schema maximum and enforce the same server-side cap.","Remove stale schemes or attach them to the intended global/operation requirements."]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_6CUUaNAIp-y-q0w7JkHYe","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Audits a built-in vulnerable OpenAPI 3.1 contract against deterministic OWASP API Security Top 10 2023 checks and returns risk score, findings, and remediation plan without active scanning","exampleAgentPrompt":"Run an OWASP API Security Top 10 audit on the insecure-admin-contract scenario and give me the risk score, verdict, and remediation steps — no active scanning, just static contract analysis.","exampleUseCases":null,"resultDescription":"Returns a JSON object with analysis_id, analyzer_version, label, profile (internet/internal), verdict (BLOCK/WARN/PASS), integer risk_score (0-100), summary text, per-operation analysis array, findings array with OWASP-mapped issues, a remediation_plan list, and a coverage object showing which checks were applied.","failureModes":["Invalid or missing scenario param returns an error — only 'insecure-admin-contract' is accepted","Unsupported HTTP method returns 405 — only GET/HEAD/DELETE are allowed","Payment failure or missing x402 header returns 402 Payment Required","Service unavailable returns 503 with no analysis output"],"whenToPreferThis":"Choose this endpoint when you need a deterministic, static OWASP API Security Top 10 2023 contract-level audit without spinning up active scanners or sending live traffic to a target API. Ideal for CI/CD pipelines, security demos, or evaluating what a full API audit report looks like before implementing against real specs.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T18:47:53.456Z","isFirstParty":false}