Per OWASP ASVS V13: secure APIs + web services. Requirements include (a) implement authentication + authorisation consistently across all API endpoints + (b) implement input validation + output encoding + against OWASP API Security Top 10 + (c) maintain API documentation + version management + lifecycle including secure retirement + (d) implement rate limiting + quota management + bot management against abuse + (e) protect against API-specific attacks (BOLA + BFLA + BOPLA + SSRF + Mass Assignment + Excessive Data Exposure) + (f) implement API gateway controls (authentication + rate limiting + logging + threat protection) + (g) align to OWASP API Security Top 10 controls.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.