The 10 most critical API security risks - Part 9: Improper Assets Management 
Tags: api, apisecurity, owasp, security
Published: 2020-03-24 20:00:30

---
title: The 10 most critical API security risks - Part 9: Improper Assets Management 
published: true
description: The recently published OWASP API security top 10 report analyzes the anti-patterns that lead to vulnerabilities and security risks in APIs. In this 10 part series, we introduce these API anti-patterns. Every API professional should know about these anti-patterns. API
tags: API, API Security, owasp, Security
canonical_url: https://api-university.com/blog/api-security/the-10-most-critical-api-security-risks-part-9-improper-assets-management/
cover_image: 
series: API-University - OWASP API security risks
---

 The recently published *“OWASP API security top 10”* report analyzes the anti-patterns that lead to vulnerabilities and security risks in APIs. In this 10 part series, we introduce these API anti-patterns. Every API professional should know about these anti-patterns.

![](https://api-university.com/wp-content/uploads/2020/01/owasp-api-09-1024x473.png)
Improper Assets Management from the [OWASP API security paper](https://github.com/OWASP/API-Security/raw/master/2019/en/dist/owasp-api-security-top-10.pdf)**API security anti-pattern for Improper Assets Management**

APIs tend to expose more endpoints than traditional web applications, making proper and updated documentation highly important. Proper hosts and deployed API versions inventory also play an important role to mitigate issues such as deprecated API versions and exposed debug endpoints.

**Want to learn more?**

- [Part 1 Broken Object Level Authorization ](https://api-university.com/blog/api-security/the-10-most-critical-api-security-risks---part-1:-broken-object-level-authorization)
- [Part 2 Broken User Authentication](https://api-university.com/blog/the-10-most-critical-api-security-risks---part-2:-broken-user-authentication)
- [Part 3 Excessive Data Exposure](https://api-university.com/blog/the-10-most-critical-api-security-risks---part-3:-excessive-data-exposure)
- [Part 4 Lack of Resources & Rate Limiting](https://api-university.com/blog/api-security/the-10-most-critical-api-security-risks---part-4:-lack-of-resources-&-rate-limiting/)
- [Part 5 Broken Function Level Authorization](https://api-university.com/blog/the-10-most-critical-api-security-risks---part-5:-broken-function-level-authorization)
- [Part 6 Mass Assignment](https://api-university.com/blog/api-security/the-10-most-critical-api-security-risks---part-6:-mass-assignment)
- [Part 7 Security Misconfiguration](https://api-university.com/blog/api-security/the-10-most-critical-api-security-risks---part-7:-security-misconfiguration)
- [Part 8 Injection](https://api-university.com/blog/api-security/the-10-most-critical-api-security-risks---part-8:-injection)
- [Part 9 Improper Assets Management](https://api-university.com/blog/api-security/the-10-most-critical-api-security-risks---part-9:-improper-assets-management)

Check out the complete [OWASP API security paper](https://github.com/OWASP/API-Security/raw/master/2019/en/dist/owasp-api-security-top-10.pdf). To secure access to your APIs, learn more about the OAuth in the [OAuth Book](https://api-university.com/books/oauth-2-0-book/), or the [OAuth Course](https://api-university.com/courses/oauth-2-0-course/). To provide and use identity data in apps and APIs, learn more about OpenID Connect in the [OpenID Connect Book](https://api-university.com/books/openid-connect/), or the [OpenID Connect Course](https://api-university.com/courses/openid-connect/).