Read operations (GET, HEAD) should be secured by at least one security scheme to prevent unauthorized access to sensitive data.
OWASP API2 2023 Read Restricted
Message: This read operation is not protected by any security scheme.
Rule Details
Severity
warn
Given
$.paths[*][get,head]
Slug
owasp-api2-2023-read-restricted-warn
Discover APIs
Search across thousands of APIs on apis.io →
Work with this as data
Every rule here is available over the API and to AI agents over MCP.
Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.
MCP tools for rules
6 tools reach this content
-
find_building_blocksBrowse every rules entry — call it with type="rules". -
get_building_blockOne rules entry in full; add include=content for the body (Pro). -
search_api_evangelistSearch every content type across the network at once. -
find_relatedThe shared-tag relevance graph — what else covers this. -
get_tagEverything one tag labels, across all content types. -
guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
Call it yourself
curl for this page
This rule
curl "https://api.apievangelist.com/v1/rules/owasp-api2-2023-read-restricted-warn"
Full body (Pro)
curl "https://api.apievangelist.com/v1/rules/owasp-api2-2023-read-restricted-warn?include=content" \
-H "x-api-key: $AE_KEY"
Related across the network
curl "https://api.apievangelist.com/v1/rules/owasp-api2-2023-read-restricted-warn/related"
All rules
curl "https://api.apievangelist.com/v1/rules?limit=25"Discovery needs no key. Full bodies and the synthesis endpoints are Pro.
Get an API key
Free tier, no email required. Sign in with whichever identity you already have.
A second provider on the same verified email joins the account you already have. Your account