The OWASP API Security Top 10 is not the same list as the web application Top 10. APIs are consumed by code, so the classic injection and XSS risks matter less, and authorization failures dominate: an endpoint that authenticates you correctly but does not check that the object you asked for is yours. This is the list translated into Laravel fixes.

1. Broken object level authorization (BOLA / IDOR)

The most common and most damaging API flaw: GET /orders/42 returns order 42 to any authenticated user, not just its owner. Authentication is not authorization. Check ownership on every object access, with a policy, and let the framework enforce it.

// OrderPolicy
public function view(User $user, Order $order): bool
{
    return $order->customer_id === $user->id;
}

// Controller
public function show(Order $order)
{
    $this->authorize('view', $order); // 403 if not the owner
    return new OrderResource($order);
}

2. Broken authentication

Weak token handling, no rate limit on login, credentials in the URL. Use Sanctum or JWT correctly, rate-limit the auth endpoints hard, keep tokens out of the query string, and store browser tokens in httpOnly cookies. Short-lived access tokens plus rotating refresh tokens limit the blast radius of a leak.

3. Broken object property level authorization

Two directions: mass assignment lets a client set fields it should not (is_admin, account_id), and over-exposure returns fields it should not see. Guard writes with a strict $fillable or Form Request rules, and shape every response through an API Resource that lists exactly what is public.

4. Unrestricted resource consumption

No rate limiting, unbounded list endpoints, expensive queries, unlimited file uploads. Apply a named rate limiter per user and per key, cap page size, whitelist sortable and filterable fields so a client cannot force a full scan, and set upload size and type limits.

5. Broken function level authorization

Admin actions reachable by regular users because the route is only "hidden". Protect privileged endpoints with a gate or middleware that checks the role or ability, group them under their own middleware, and never rely on the client not knowing the URL.

6. Server-side request forgery (SSRF)

Any feature that fetches a URL the user supplied (webhooks, image imports, link previews) can be pointed at your internal network or cloud metadata endpoint. Validate the URL, resolve it, and reject private and link-local IP ranges before the request goes out. An allowlist of permitted hosts is stronger than a blocklist.

7. Security misconfiguration

APP_DEBUG on in production leaking stack traces and config, permissive CORS, missing security headers, verbose error messages. Ship with debug off, lock CORS to known origins, set the standard security headers, and return the RFC 9457 problem shape without internal detail.

8. Improper inventory management

Old API versions still live and unpatched, staging endpoints exposed, undocumented routes. Keep an accurate inventory, retire deprecated versions on an announced schedule, and make sure non-production environments are not reachable from the internet.

Risk, symptom, Laravel fix

API security is mostly authorization done consistently: every object access checks ownership, every privileged action checks ability, every input is validated and every response is shaped. Walk the OWASP API Top 10 against your endpoints once, add the missing checks, and cover them with tests so they stay.