> For the complete documentation index, see [llms.txt](https://docs.xygeni.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.xygeni.io/xygeni-products/api-security/api-security-detectors.md). # API Security Detectors The API Security scanner ships with twelve built-in detectors, each mapped to an entry of the **OWASP API Security Top 10 (2023)** as the primary taxonomy, and to one or more **CWE** identifiers as the secondary taxonomy. | Detector ID | Risk | OWASP API (2023) | CWE | Default severity | | -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | --------------------- | ------------------------- | ------------------------------------------ | | `broken_object_level_authorization` | Object access by ID with no ownership check (IDOR). | API1:2023 | CWE-639, CWE-284 | high | | `unauthenticated_endpoint` | Endpoint reachable without authentication. | API2:2023 | CWE-306 | high | | `jwt_misconfiguration` | `alg: none`, signature verification disabled, hardcoded HMAC secret, expiration disabled. | API2:2023 | CWE-347, CWE-327, CWE-757 | high (critical tiers) | | `sensitive_param_unauthenticated` | PII / PCI / PHI / credential parameter on an unauthenticated endpoint. | API2:2023, API3:2023 | CWE-359, CWE-522 | high | | `excessive_data_exposure` (Java, Python, C#, JS / TS, Go, PHP) | Response shape contains sensitivity-tagged fields the client did not ask for. | API3:2023 | CWE-213, CWE-200 | high | | `mass_assignment` | Request body binds to privileged attributes (`admin`, `role`, `isAdmin`, …). | API3:2023 | CWE-915 | high (low for identity / financial fields) | | `pii_leak_in_response` (Java, Python, C#, JS / TS, Go, PHP) | Response carries PII / PCI / PHI fields. Composite CRITICAL when combined with unauthenticated endpoint. | API3:2023, API10:2023 | CWE-359 | high | | `rate_limit_absence` | Auth-required endpoint with no recognised rate-limiting library or middleware. | API4:2023 | CWE-770 | low | | `broken_function_level_authorization` | Admin-shaped or destructive-verb endpoint with no role check (BFLA). | API5:2023 | CWE-285, CWE-269 | high | | `ssrf` | URL-shaped input parameter; severity lifts to HIGH when the handler also performs an outgoing HTTP fetch. | API7:2023 | CWE-918 | low (high tier) | | `cors_misconfiguration` | Permissive CORS (wildcard origin, especially with credentials). | API8:2023 | CWE-942, CWE-346 | low (high tier) | | `zombie_endpoint` / `orphan_spec` | Drift between source code and OpenAPI / Swagger descriptors (shadow API or orphan operation). | API9:2023 | CWE-1059 | high | The full per-detector documentation — with description, rationale, vulnerable / fixed code examples per language, framework-specific remediation, and the complete reference list — is published at [detectors.xygeni.io](https://detectors.xygeni.io/xydocs/apisec/detectors/index.html). ### Per-Language Coverage Two detectors — `excessive_data_exposure` and `pii_leak_in_response` — ship with **per-language** implementations so the rationale and remediation pages can speak the idiom of the target stack. Coverage: | Language | Frameworks recognised | | -------- | ---------------------------------------------- | | Java | Spring MVC / Spring Boot, JAX-RS | | C# | ASP.NET Core (Controllers + Minimal APIs) | | Python | FastAPI, Flask, Django / Django REST Framework | | JS / TS | Express, NestJS, Koa, Fastify, Hono | | Go | net/http, Gin, Echo, Chi, Fiber, gorilla/mux | | PHP | Laravel, Symfony, Slim | All other detectors operate at the **model level** (HTTP method + path shape + authentication evidence) so they apply uniformly across every supported framework. Several model-level detectors are augmented with per-language source walking that confirms or refines the verdict — for example, the BOLA / BFLA detectors walk the handler body for explicit ownership / role checks, and SSRF walks for outgoing-HTTP-fetch calls. ### Sensitivity Classification Both `excessive_data_exposure` and `pii_leak_in_response` rely on the **sensitivity classifier**, which tags parameters and DTO fields by their *kind* — PII, PCI, PHI, credential, crypto material — based on field names, schema annotations, and (where available) framework-specific markers. The classifier is configured globally on the scan, not per-detector; see the [scanner configuration page](/xygeni-products/api-security/api-security-scanner/api-security-scanner-configuration.md) for details on overriding tags for false-positive fields. ### Compliance Tags Where applicable, findings carry tags that map the underlying risk to the most relevant compliance controls: * **GDPR** — Article 32 (security of processing). * **PCI-DSS v4.0** — Requirements 3.4 (render PAN unreadable), 6.4.3 (protection against payment-page tampering), 7.1 / 7.2 (least privilege), 8 (identify and authenticate access). * **NIST SP 800-53** — AC-3 (access enforcement), AC-6 (least privilege), IA-2 (identification and authentication), IA-5 (authenticator management). Tags appear on the finding's metadata in the UI and in the JSON / SARIF report output, so API Security findings flow into existing compliance dashboards alongside SAST, SCA, and Secrets findings. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.xygeni.io/xygeni-products/api-security/api-security-detectors.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.