The OWASP API Security Top 10 is an excellent cheat sheet that helps you understand the highest vulnerabilities that plague APIs, such as business logic flaws.
Business logic flaws are features of an application that can be used maliciously because they’re vulnerable by design. In other words, these flaws are present in an application’s code and are exceedingly difficult to detect for most automated scans.