What is the difference between the OWASP Top 10 (Web) and the OWASP API Top 10?

Short answer

Both are OWASP security risk lists, but they cover different targets. The OWASP Top 10 (Web) ranks the ten most critical risk categories of web applications with the codes A01-A10 (e.g. A01 Broken Access Control, A03 Injection); the OWASP API Security Top 10, on the other hand, ranks ten risks specific to APIs with the codes API1-API10 (e.g. API1 Broken Object Level Authorization, API4 Unrestricted Resource Consumption, API6 Unrestricted Access to Sensitive Business Flows). TR7 maps the WAF signatures to the two lists separately and uses the codes of the 2021 Web and 2023 API editions: there are the OWASP Web Coverage and OWASP API Coverage cards in Signature & Rule Library, the Detected Attacks by OWASP Top 10 (Web) and Detected Attacks by OWASP API Top 10 charts in the WAF Dashboard, and the OWASP Web and OWASP API filters in WAF Event Logs.

Where It Is Used in TR7

Where	Field / label	What for
WAF → Signature & Rule Library	OWASP Web Coverage, OWASP API Coverage cards, columns and Filter groups	How many items of the two lists the library covers; the mapping of a rule
Signature & Rule Library → rule preview	Classification tab → OWASP Web, OWASP API	The codes of a rule in the two lists
WAF-Protected vService → Dashboard	Detected Attacks by OWASP Top 10 (Web), Detected Attacks by OWASP API Top 10	The distribution of the detections across the A01-A10 and API1-API10 categories
WAF-Protected vService → Event Logs	OWASP Web, OWASP API filters	Filtering the records by the two lists
WAF Management → WAF Report	Classification tab → OWASP Web, OWASP API	The breakdown of the period's detections by the two lists
WAF Management → SIEM & Attack Details	Attack details in WAF info → OWASP Web (List), OWASP API (List)	Adding the codes of the two lists to the attack record sent to the SIEM

Comparison

	OWASP Top 10 (Web)	OWASP API Security Top 10
Scope	Web applications	APIs such as REST and GraphQL
Code format (edition in TR7)	A01:2021 … A10:2021	API1:2023 … API10:2023
Prominent risks	Access control, injection, insecure design, SSRF	Authorization at the object and function level, resource consumption, unrestricted access to sensitive business flows, unsafe consumption of APIs
TR7 chart	Detected Attacks by OWASP Top 10 (Web)	Detected Attacks by OWASP API Top 10

Common Misconceptions

• "APIs are protected only with the API Top 10." APIs are also exposed to web risks such as injection; in TR7, a rule can be mapped to both lists at once, and the two lists complement each other.
• "The two lists are different numberings of the same categories." The API list highlights risks specific to APIs, such as object-level authorization and business flow abuse, as separate categories.
• "Every rule has a mapping in both lists." A rule may be mapped in only one of them or in neither; in the custom rules added by the user, these fields remain empty.

Protecting APIs with the TR7 WAF: Can I protect my REST APIs with TR7 WAF?

How it is done in the documentation

• Signature & Rule Library · The Library Summary Cards
• WAF Dashboard · Detected Attacks by OWASP Top 10 (Web)
• WAF Dashboard · Detected Attacks by OWASP API Top 10

Related questions

• How do I see which OWASP Top 10, CWE, CAPEC and MITRE ATT&CK entries a rule maps to?
• Can I protect my REST APIs with TR7 WAF?
• What are OWASP and the OWASP Top 10; where do they appear in the TR7 WAF?