API Security Posture Score
Answer 40 questions about how your organisation builds and runs APIs and get a score from 0 to 100, a maturity level per area that your evidence has to back up, the five biggest gaps mapped to the OWASP API Security Top 10 2023, and a 30/60/90-day plan to close them. It takes about ten minutes.
Scored in your browser. Progress is saved in this browser only. A self-assessment, not an audit.
Progress is saved in this browser only; nothing is sent to PlayCISO.
1. Inventory and ownership
TL;DRWhat this assessment does
5 points
- 40 questions across 10 areas: inventory and ownership, authentication, authorisation, input validation, data exposure, rate limiting, logging, secrets, third-party APIs, and testing.
- Each area has two maturity questions (0 to 4) and two evidence questions (have it, partly, no, don’t know).
- You get a score from 0 to 100 and a maturity level from 1 to 5 per area. Evidence caps the level: level 4 needs 67% evidence, level 5 needs 83%.
- The top 5 gaps are mapped to the OWASP API Security Top 10 2023, with a 30/60/90-day plan and labs for your weakest areas.
- The assessment and results are free and run in your browser. CSV and Markdown export are part of Pro.
Why the score asks for evidence
Most API security questionnaires ask how mature you are and accept the answer. The trouble is that “we check authorisation in every handler” and “we have tests that prove one customer cannot read another customer’s orders” are different claims, and only the second one survives an incident review. Each area here pairs two maturity questions with two evidence questions, and the evidence decides how high the area’s level can go. If you answer “don’t know”, the tool treats it as missing evidence and puts “find out” at the top of your 30-day plan.
How the areas map to the OWASP API Security Top 10 2023
Authorisation questions cover API1 Broken Object Level Authorization and API5 Broken Function Level Authorization. Data exposure and schema questions cover API3 Broken Object Property Level Authorization, which in 2023 merged excessive data exposure and mass assignment. Rate limiting covers API4 Unrestricted Resource Consumption and API6 Unrestricted Access to Sensitive Business Flows. Third-party questions cover API7 Server Side Request Forgery and API10 Unsafe Consumption of APIs, and inventory questions cover API9 Improper Inventory Management. Authentication and secrets map to API2 Broken Authentication, and configuration items to API8 Security Misconfiguration.
For the weakest areas the results point to hands-on practice: the API Data Exposure Review Lab for property-level authorisation, the JWT Attack & Defense Lab for token validation, and the SSRF Defense Checklist for outbound requests.
Frequently asked questions
What is an API security posture score?
A single 0–100 number that summarises how well your organisation controls API risk across ten areas, from knowing which APIs exist to testing them before release. This tool calculates it from 40 self-assessment answers: each area score is the weighted mean of its four answers, and the overall score is the average of the ten areas.
How does evidence cap the maturity level?
Each area has evidence questions that ask whether you can produce something: an owner list, a test suite, a register of third-party APIs. Your maturity answers can only carry an area so far without that proof. Level 3 needs at least 33% on the evidence questions, level 4 needs 67% and level 5 needs 83%. “Don’t know” counts as missing evidence. The results say when a level was capped and why.
How are gaps mapped to the OWASP API Security Top 10 2023?
Every question is tied to the 2023 item it most directly reduces: for example object-level authorisation to API1 Broken Object Level Authorization, mass assignment and over-returned fields to API3 Broken Object Property Level Authorization, rate limits to API4 Unrestricted Resource Consumption, outbound URL fetching to API7 Server Side Request Forgery, and API inventory to API9 Improper Inventory Management. Logging is not its own item in the 2023 list, so logging questions map to the risk they help you detect.
How is the 30/60/90-day plan built?
Every answer below the strongest option is a gap. Gaps are ranked by the weighted points they cost, then placed by effort: quick fixes and anything you answered “don’t know” go in the first 30 days, shared controls such as central authorisation and rate limits in days 31–60, and structural work such as security testing in CI in days 61–90. Each phase holds at most six items.
Is my data stored or sent anywhere?
No. The questions are scored in your browser and progress is saved in this browser’s local storage. The share link puts your answers in the URL itself, so PlayCISO stores nothing; anyone you give the link to can see the answers. The organisation name is never put in the link.
Is the API Security Posture Score free?
The assessment, the score, the levels, the top gaps, the 30/60/90-day plan and the share link are free. Exporting the full report to CSV or Markdown is part of Pro ($5/month or $40/year).
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.