OWASP API Security Top 10 2019 Checklist

general > improper-assets-management-environment-info

Guidance

The purpose of an API host is unclear, and there are no explicit answers to the following questions:
- Which environment is the API running in, for example, production, staging, test, or development?
- Who should have network access to the API, for example, public, internal, or partners?

Applies to WebAPI

Constraint

Type: Declarative Validation