Address API4:2023 Unrestricted Resource Consumption + API6:2023 Unrestricted Access to Sensitive Business Flows per OWASP API Security Top 10 2023. Unrestricted Resource Consumption occurs when APIs do not limit CPU + memory + network + disk + database + or external API consumption by clients allowing DoS or cost amplification attacks. Unrestricted Access to Sensitive Business Flows occurs when APIs expose business workflows (account creation + ticket purchase + comment posting + transaction approval) to abuse via automation + scraping + scalping + fake review generation. Mitigations include (a) implement rate limiting at gateway + service layers per endpoint per client + (b) implement quota management for resource-intensive operations, (c) bot management for sensitive business flows including CAPTCHA + device fingerprinting + behavioural analysis + (d) cost controls for expensive operations (compute + database + external API), (e) timeout enforcement + circuit breakers + bulkheads.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.