Free tool · Pro roadmap pack · OWASP API Top 10 2023

API Security Roadmap Builder

Answer ten questions and get a phased API security program: what to do in the first 30, 60 and 90 days, then by month 6 and month 12. Every item has an owner role, an effort size, the OWASP API Security Top 10 2023 item it reduces, a success metric and a link to the PlayCISO lab or tool that practises or produces it. The plan is sized to your team, and download and print are free.

Guidance generated from your answers, not a standard or an audit result. Saved in your browser only. See every API security tool and lab →

1. Ten questions

0/10 answered

1.What is the state of your API inventory today?

Inventory and ownership

2.How mature is authentication across your APIs?

Authentication

3.How are object-level and function-level authorisation checked?

Authorisation (object and function level)

4.How much of your API traffic goes through a gateway with a security baseline?

Gateway coverage and limits

5.How do your APIs control which fields go out and which fields can be written?

Data exposure and schemas

6.How are APIs tested for security?

Testing (spec, DAST, contract)

7.How do you watch APIs in production?

Runtime monitoring

8.How do you handle the third-party APIs and webhooks you consume?

Third-party APIs and webhooks

9.Who will do the work?

Sets how much fits in each phase and who owns each item.

10.Which regulatory or audit drivers apply? (any)

These raise the priority of related areas and add a scoping or evidence item. They do not interpret the regulation.

Answers are saved in this browser only; nothing is sent to PlayCISO.

2. Your roadmap

Guidance, not a standard or an audit result. The sequence, effort and owners come from your answers by fixed rules. Adjust them to your organisation before you commit to dates. You have answered 0 of 10; unanswered areas are planned as level 0 and the team defaults to 1–2 security people.

Organisation (optional, for exports)

The roadmap, Markdown download and print view are free. The roadmap pack adds a RACI table for every phase and a board-ready one-page summary, and is part of Pro.

Items in 12 months

Backlog beyond 12 months

Estimated effort

35–74 person-weeks

Areas at level 2+

0 of 8

Days 0–30 · Ownership, a baseline and the quickest risk reduction.

4 of 4 effort points

Name an accountable owner for API security
Program
Name one accountable owner, agree which APIs are in scope, and set a monthly 30-minute review of this roadmap.
Owner: CISO / head of securitySmall (days)API9 Improper Inventory Management
Success metric: Owner named and scope agreed in writing.
Practise or produce it: API Security Policy Builder →
Every roadmap starts and ends with these.
Record a baseline posture score
Program
Score all ten areas with evidence so progress can be shown against a starting point.
Owner: Security engineerSmall (days)API1–API10 (all)
Success metric: Baseline score recorded for every area.
Practise or produce it: API Security Posture Score →
Every roadmap starts and ends with these.
Adopt an API security policy
Program
Publish a policy with testable MUST statements per OWASP item, and an exceptions process with expiry dates.
Owner: Security engineerMedium (2–4 person-weeks)API1–API10 (all)
Success metric: Policy approved; every exception logged with an owner and an expiry date.
Practise or produce it: API Security Policy Builder →
A written policy makes the rest of the roadmap enforceable.

Days 31–60 · Close the biggest gaps in the weakest areas.

4 of 4 effort points

Build a first API inventory
Inventory and ownership
Pull every host and route from gateway config, DNS, cloud load balancers and code repositories into one list with owner, environment and data class.
Owner: Platform / API gateway teamMedium (2–4 person-weeks)API9 Improper Inventory Management
Success metric: Share of internet-reachable API hosts in the inventory with a named owner.
Practise or produce it: Shadow API Discovery Lab →
Not answered, so planned from scratch (level 0 of 3). This step reaches level 1.
Close unauthenticated endpoints
Authentication
List every endpoint that answers without credentials, make deny-by-default the gateway and framework setting, and keep a reviewed list of approved public endpoints.
Owner: Security engineerMedium (2–4 person-weeks)API2 Broken Authentication
Success metric: Unauthenticated endpoints not on the approved public list (target 0).
Practise or produce it: API & Service Auth Lab →
Not answered, so planned from scratch (level 0 of 3). This step reaches level 1.

Days 61–90 · Make the fixes repeatable: policy, shared libraries, CI.

5 of 5 effort points

Map where object and function checks happen
Authorisation (object and function level)
For the most sensitive APIs, list every endpoint that takes an object ID and every admin function, and record where ownership and role are checked (or that they are not).
Owner: Security engineerMedium (2–4 person-weeks)API1 Broken Object Level Authorization API5 Broken Function Level Authorization
Success metric: Share of high-sensitivity endpoints with a documented object-level and function-level check.
Practise or produce it: API Security Policy Builder →
Not answered, so planned from scratch (level 0 of 3). This step reaches level 1.
Stop returning whole objects
Data exposure and schemas
Find endpoints that serialise database objects directly and switch the most sensitive ones to allow-listed response models.
Owner: Engineering managers (API owners)Medium (2–4 person-weeks)API3 Broken Object Property Level Authorization
Success metric: High-sensitivity endpoints using allow-listed response models.
Practise or produce it: API Data Exposure Lab →
Not answered, so planned from scratch (level 0 of 3). This step reaches level 1.
Check every spec for security gaps
Testing (spec, DAST, contract)
Run security checks on your OpenAPI specs (missing auth, wildcard scopes, unbounded arrays, internal servers) and fix the high-severity findings.
Owner: Security engineerSmall (days)API8 Security Misconfiguration API4 Unrestricted Resource Consumption
Success metric: Open high-severity spec findings.
Practise or produce it: OpenAPI Spec Gap Analyser →
Not answered, so planned from scratch (level 0 of 3). This step reaches level 1.

Months 4–6 · Extend coverage and start measuring.

10 of 10 effort points

Put every public API behind the gateway
Gateway coverage and limits
Route every internet-facing API host through the gateway (or WAF) so authentication and limits can be enforced in one place.
Owner: Platform / API gateway teamMedium (2–4 person-weeks)API8 Security Misconfiguration API2 Broken Authentication
Success metric: Share of public API hosts routed through the gateway.
Practise or produce it: API Gateway Config Lab →
Not answered, so planned from scratch (level 0 of 3). This step reaches level 1.
Collect API logs centrally
Runtime monitoring
Log caller identity, route, status, latency and request ID at the gateway, ship them to your log platform, and keep tokens and secrets out of logs.
Owner: Platform / API gateway teamMedium (2–4 person-weeks)API9 Improper Inventory Management
Success metric: Share of API traffic with centrally searchable logs.
Practise or produce it: Shadow API Discovery Lab →
Not answered, so planned from scratch (level 0 of 3). This step reaches level 1.
List the third-party APIs and webhooks you rely on
Third-party APIs and webhooks
For each integration record the owner, direction, data shared and the credential used.
Owner: Security engineerSmall (days)API10 Unsafe Consumption of APIs
Success metric: Share of integrations with an owner and a data classification.
Practise or produce it: API Security Policy Builder →
Not answered, so planned from scratch (level 0 of 3). This step reaches level 1.
Require a spec and an owner before go-live
Inventory and ownership
Make an OpenAPI spec in the repo and a named owner team required release fields; refuse gateway routes without them.
Owner: Platform / API gateway teamMedium (2–4 person-weeks)API9 Improper Inventory Management
Success metric: Share of production APIs with a current spec in the repo.
Practise or produce it: OpenAPI Spec Gap Analyser →
Not answered, so planned from scratch (level 0 of 3). This step reaches level 2.
Pin token validation in one shared library
Authentication
One validation library with an algorithm allow-list, issuer, audience and expiry checks, and tests that reject alg:none, the wrong audience and expired tokens.
Owner: Security engineerMedium (2–4 person-weeks)API2 Broken Authentication
Success metric: Share of services using the shared token validation library.
Practise or produce it: JWT Attack & Defense Lab →
Not answered, so planned from scratch (level 0 of 3). This step reaches level 2.
Report API security metrics quarterly
Program
A one-page quarterly update to leadership: the success metrics in this roadmap, trend per area, and exceptions.
Owner: CISO / head of securitySmall (days)API1–API10 (all)
Success metric: Quarterly report delivered with a trend for each area.
Practise or produce it: API Security Posture Score →
Every roadmap starts and ends with these.

Months 7–12 · Automate, sustain and re-score.

15 of 16 effort points

Move authorisation into a shared layer
Authorisation (object and function level)
Adopt the rules (owner check on every object read and write, admin functions denied by default) and enforce them in shared middleware instead of per handler.
Owner: Engineering managers (API owners)Large (1–3 person-months)API1 Broken Object Level Authorization API5 Broken Function Level Authorization
Success metric: Share of services using the central authorisation layer.
Practise or produce it: API Security Policy Builder →
Not answered, so planned from scratch (level 0 of 3). This step reaches level 2.
Strict request schemas against mass assignment
Data exposure and schemas
Separate read and write schemas, reject unknown properties, bound arrays and strings, and never bind role, owner or price fields from the request body.
Owner: Engineering managers (API owners)Medium (2–4 person-weeks)API3 Broken Object Property Level Authorization API4 Unrestricted Resource Consumption
Success metric: Share of write endpoints with a strict request schema.
Practise or produce it: OpenAPI Spec Gap Analyser →
Not answered, so planned from scratch (level 0 of 3). This step reaches level 2.
Apply a gateway security baseline
Gateway coverage and limits
Authentication on every route, request size limits, a CORS allow-list, TLS settings, generic error bodies and admin routes blocked from the internet.
Owner: Platform / API gateway teamMedium (2–4 person-weeks)API8 Security Misconfiguration API5 Broken Function Level Authorization
Success metric: Share of gateway routes passing the baseline check.
Practise or produce it: API Gateway Config Lab →
Not answered, so planned from scratch (level 0 of 3). This step reaches level 2.
Spec checks and DAST in the pipeline
Testing (spec, DAST, contract)
Run spec linting and an API-aware DAST scan on each release of every internet-facing API.
Owner: Security engineerMedium (2–4 person-weeks)API8 Security Misconfiguration API2 Broken Authentication
Success metric: Share of internet-facing APIs scanned on each release.
Practise or produce it: OpenAPI Spec Gap Analyser →
Not answered, so planned from scratch (level 0 of 3). This step reaches level 2.
Alert on authentication and limit signals
Runtime monitoring
Alerts for spikes in 401 and 403 responses, failed logins per account, 429s and 5xx errors per route.
Owner: On-call engineering / SOCMedium (2–4 person-weeks)API2 Broken Authentication API4 Unrestricted Resource Consumption
Success metric: Median time from API alert to triage.
Practise or produce it: Rate-Limit & Abuse Tuner →
Not answered, so planned from scratch (level 0 of 3). This step reaches level 2.
Verify webhooks and validate partner data
Third-party APIs and webhooks
Signature verification with a replay window on inbound webhooks; schema validation, timeouts and size limits on responses from partner APIs.
Owner: Engineering managers (API owners)Medium (2–4 person-weeks)API10 Unsafe Consumption of APIs
Success metric: Share of inbound webhooks verified and partner calls with timeouts and response validation.
Practise or produce it: API Security Policy Builder →
Not answered, so planned from scratch (level 0 of 3). This step reaches level 2.
Re-score and refresh the roadmap
Program
Re-run the posture score with evidence, compare with the baseline, and build next year’s roadmap from the new answers.
Owner: Security engineerSmall (days)API1–API10 (all)
Success metric: Change in score per area against the baseline.
Practise or produce it: API Security Posture Score →
Every roadmap starts and ends with these.

Beyond 12 months (backlog)

These did not fit your team's capacity in year one. Pull them forward if you add people or narrow scope.

Automate discovery and retire zombie versions (Inventory and ownership; API9, API8) · Shadow API Discovery Lab
Short-lived tokens and tested revocation (Authentication; API2) · Token Lifecycle Lab
Test authorisation automatically (Authorisation (object and function level); API1, API5) · OpenAPI Spec Gap Analyser
Classify sensitive fields and check every PR (Data exposure and schemas; API3) · API Data Exposure Lab
Tune rate limits per endpoint and identity (Gateway coverage and limits; API4, API6) · Rate-Limit & Abuse Tuner
Contract and abuse-case tests (Testing (spec, DAST, contract); API3, API4) · API Data Exposure Lab
Detect enumeration and business-flow abuse (Runtime monitoring; API6, API1) · Rate-Limit & Abuse Tuner
Control outbound requests (Third-party APIs and webhooks; API7) · SSRF Defense Checklist
Keep the inventory honest (Inventory and ownership; API9) · Shadow API Discovery Lab
Workload identity between services (Authentication; API2, API8) · mTLS Handshake Lab
Authorisation in every design review (Authorisation (object and function level); API1, API5) · API Security Policy Builder
Schema validation at the gateway (Data exposure and schemas; API3, API8) · API Gateway Config Lab
Gateway configuration as code (Gateway coverage and limits; API8) · API Gateway Config Lab
Expert testing on the riskiest APIs (Testing (spec, DAST, contract); API1, API6) · Rate-Limit & Abuse Tuner
API incident playbooks and drills (Runtime monitoring; API2) · Leaked Credential Response
Review vendors and app consents on a schedule (Third-party APIs and webhooks; API10, API2) · OAuth Consent Lab

TL;DR

What this builder does

5 points

Answer ten questions: inventory, authentication, authorisation, gateway coverage, data exposure, testing, runtime monitoring, third-party APIs, team size and regulatory drivers.
Get a phased plan for days 0–30, 31–60 and 61–90, then months 4–6 and 7–12, sized to the team you have. What does not fit in a year is listed as backlog rather than hidden.
Every item names an owner role, an effort size, the OWASP API Security Top 10 2023 item it reduces, a success metric and the PlayCISO lab or tool that practises or produces it.
Free: the roadmap, Markdown download and print or save-as-PDF. Pro: the roadmap pack, a RACI table for each phase plus a board-ready one-page summary.
It is guidance generated by fixed rules from your answers, not a standard or an audit result. Answers stay in your browser.

Why a roadmap, not a list of findings

An assessment tells you where the gaps are. It does not tell you which to close first with the people you have, or what to show leadership in month three. API security work also has a natural order: you cannot put every API behind a gateway before you know which APIs exist, and automated authorisation tests need a shared authorisation layer to test.

This builder encodes that order. Each area climbs one step at a time, the next step in every area comes before anyone's second step, and the riskiest areas go first. Measure where you are with the API Security Posture Score, write the rules with the API Security Policy Builder, and practise the controls in the API Gateway Config Lab and the API Data Exposure Lab.

Frequently asked questions

What should an API security roadmap include?

An accountable owner and scope, a baseline, and then work in each area that the OWASP API Security Top 10 2023 describes: an API inventory with owners (API9), authentication that is enforced everywhere (API2), object- and function-level authorisation (API1, API5), property-level data controls (API3), gateway limits and rate limiting (API4, API6, API8), outbound-call controls (API7), safe consumption of third-party APIs (API10), testing in the pipeline and runtime monitoring. Each item needs an owner, an effort estimate and a metric that shows it worked. This builder produces exactly that structure.

How does the builder decide what goes in the first 30 days?

Each area has four steps. Your answer sets the current level from 0 to 3, so only the steps above it are needed. The next step in every area is scheduled before any second step, ordered by area priority (a weight for the risk of the area times how far it is from level 3, with extra weight for areas your regulatory drivers touch). Team size sets how much effort fits in each phase. Large items never start in the first 30 days, and a step never lands before the step beneath it.

Which OWASP API Top 10 2023 items does the roadmap cover?

All ten. API1 Broken Object Level Authorization and API5 Broken Function Level Authorization through the authorisation steps; API2 Broken Authentication through authentication and token steps; API3 Broken Object Property Level Authorization through data exposure and schema steps; API4 Unrestricted Resource Consumption and API6 Unrestricted Access to Sensitive Business Flows through rate limiting, testing and monitoring; API7 Server Side Request Forgery through outbound-request controls; API8 Security Misconfiguration through the gateway baseline; API9 Improper Inventory Management through the inventory steps; and API10 Unsafe Consumption of APIs through the third-party steps.

Can I reuse my API Security Posture Score answers?

Yes. If you have completed the API Security Posture Score in the same browser, the builder offers to prefill the eight maturity answers from your area scores. Scores under 25 become level 0, under 50 level 1, under 75 level 2, and 75 or more level 3. You can change any answer afterwards.

What is free and what is Pro?

The ten questions, the full phased roadmap, the Markdown download and the print or save-as-PDF view are free. The roadmap pack is part of Pro ($5/month or $40/year): it adds a RACI table (responsible, accountable, consulted, informed) for every phase and a one-page board summary with the position, the plan, the effort, the metrics to report each quarter and the decisions to ask for.

Does selecting PCI DSS, HIPAA, GDPR or DORA make the plan compliant?

No. A regulatory selection raises the priority of the areas it usually touches and adds a scoping or evidence item, such as tagging the APIs that handle card data. The builder does not interpret any law or standard. Confirm scope and requirements with your compliance owner or assessor.

More security tools

The tools people use most on PlayCISO.

All tools

Prompt Scan

Catch injected instructions hiding in content your AI agent should only read.

ISO/IEC 27090 Readiness

Score your readiness against the first international standard for AI security threats.

CVE Trends

Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.

Firewall Lab

Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.

NIST CSF 2.0 Assessment

Self-assess all six Functions, from Govern to Recover, and see your weakest one.

APT Naming Rosetta Stone

Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.