URL parameters MUST NOT contain credentials such as API key, password, or secret. This is a security risk as URLs are often logged and cached.
OWASP API2 2023 No Credentials in URL
Message: Security credentials detected in path parameter.
Rule Details
Severity
error
Given
$..parameters[?(@.in.match(/query|path/))].name
Slug
owasp-api2-2023-no-credentials-in-url-error
Discover APIs
Search across thousands of APIs on apis.io →
Work with this as data
Every rule here is available over the API and to AI agents over MCP.
Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.
MCP tools for rules
6 tools reach this content
-
find_building_blocksBrowse every rules entry — call it with type="rules". -
get_building_blockOne rules entry in full; add include=content for the body (Pro). -
search_api_evangelistSearch every content type across the network at once. -
find_relatedThe shared-tag relevance graph — what else covers this. -
get_tagEverything one tag labels, across all content types. -
guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
Call it yourself
curl for this page
This rule
curl "https://api.apievangelist.com/v1/rules/owasp-api2-2023-no-credentials-in-url-error"
Full body (Pro)
curl "https://api.apievangelist.com/v1/rules/owasp-api2-2023-no-credentials-in-url-error?include=content" \
-H "x-api-key: $AE_KEY"
Related across the network
curl "https://api.apievangelist.com/v1/rules/owasp-api2-2023-no-credentials-in-url-error/related"
All rules
curl "https://api.apievangelist.com/v1/rules?limit=25"Discovery needs no key. Full bodies and the synthesis endpoints are Pro.
Get an API key
Free tier, no email required. Sign in with whichever identity you already have.
A second provider on the same verified email joins the account you already have. Your account