All write operations (POST, PUT, PATCH, DELETE) must be secured by at least one security scheme to prevent unauthorized modifications.
OWASP API2 2023 Write Restricted
Message: This write operation is not protected by any security scheme.
Rule Details
Severity
error
Given
$.paths[*][post,put,patch,delete]
Slug
owasp-api2-2023-write-restricted-error
Discover APIs
Search across thousands of APIs on apis.io →
Work with this as data
Every rule here is available over the API and to AI agents over MCP.
Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.
MCP tools for rules
6 tools reach this content
-
find_building_blocksBrowse every rules entry — call it with type="rules". -
get_building_blockOne rules entry in full; add include=content for the body (Pro). -
search_api_evangelistSearch every content type across the network at once. -
find_relatedThe shared-tag relevance graph — what else covers this. -
get_tagEverything one tag labels, across all content types. -
guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
Call it yourself
curl for this page
This rule
curl "https://api.apievangelist.com/v1/rules/owasp-api2-2023-write-restricted-error"
Full body (Pro)
curl "https://api.apievangelist.com/v1/rules/owasp-api2-2023-write-restricted-error?include=content" \
-H "x-api-key: $AE_KEY"
Related across the network
curl "https://api.apievangelist.com/v1/rules/owasp-api2-2023-write-restricted-error/related"
All rules
curl "https://api.apievangelist.com/v1/rules?limit=25"Discovery needs no key. Full bodies and the synthesis endpoints are Pro.
Get an API key
Free tier, no email required. Sign in with whichever identity you already have.
A second provider on the same verified email joins the account you already have. Your account