--- title: "OWASP API Security Report" url: "https://earlyaccess.developers.bynder.com/apis/webhooks-api/docs/owasp-api-security" image: "https://earlyaccess.developers.bynder.com/_og/d/c_Ocean.takumi,title_OWASP+API+Security+Report,props_eyJ0aGVtZSI6eyJtb2RlIjoibGlnaHQiLCJjb2xvcnMiOnsicHJpbWFyeSI6IiMxMjZERkUifX19,p_Ii9hcGlzL3dlYmhvb2tzLWFwaS9kb2NzL293YXNwLWFwaS1zZWN1cml0eSI,s_Sof687JUn4oxp1wN.png" --- ## [OWASP API Security — `webhooks-api`](#owasp-api-security-webhooks-api) **135 finding(s):** 64 error, 71 warn — score **0/100**. | Severity | Rule | Location | Message | | :------- | :----------------------------------------- | :-------------------------------------------------------------------------- | :------------------------------------------------------------------------------- | | error | owasp:api9:2023-inventory-access | #/servers/0 | Declare intended audience of every server by defining servers0.x-internal as true/false. | | error | owasp:api8:2023-no-server-http | #/servers/0/url | Server URLs must not use http://. Use https:// or wss:// instead. | | error | owasp:api2:2023-write-restricted | /webhooks/api/subscriptions/activate | This write operation is not protected by any security scheme. | | error | owasp:api4:2023-rate-limit | /webhooks/api/subscriptions/activate | All 2XX and 4XX responses should define rate limiting headers. | | error | owasp:api4:2023-rate-limit | /webhooks/api/subscriptions/activate | All 2XX and 4XX responses should define rate limiting headers. | | error | owasp:api2:2023-write-restricted | /webhooks/api/subscriptions | This write operation is not protected by any security scheme. | | error | owasp:api4:2023-rate-limit | /webhooks/api/subscriptions | All 2XX and 4XX responses should define rate limiting headers. | | error | owasp:api4:2023-rate-limit | /webhooks/api/subscriptions | All 2XX and 4XX responses should define rate limiting headers. | | error | owasp:api2:2023-write-restricted | /webhooks/api/subscriptions | This write operation is not protected by any security scheme. | | error | owasp:api4:2023-rate-limit | /webhooks/api/subscriptions | All 2XX and 4XX responses should define rate limiting headers. | | error | owasp:api4:2023-rate-limit | /webhooks/api/subscriptions | All 2XX and 4XX responses should define rate limiting headers. | | error | owasp:api2:2023-write-restricted | /webhooks/api/subscriptions/{configId} | This write operation is not protected by any security scheme. | | error | owasp:api4:2023-string-limit | /webhooks/api/subscriptions/{configId} | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | /webhooks/api/subscriptions/{configId} | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-rate-limit | /webhooks/api/subscriptions/{configId} | All 2XX and 4XX responses should define rate limiting headers. | | error | owasp:api4:2023-rate-limit | /webhooks/api/subscriptions/{configId} | All 2XX and 4XX responses should define rate limiting headers. | | error | owasp:api4:2023-rate-limit | /webhooks/api/subscriptions/list | All 2XX and 4XX responses should define rate limiting headers. | | error | owasp:api4:2023-rate-limit | /webhooks/api/subscriptions/list | All 2XX and 4XX responses should define rate limiting headers. | | error | owasp:api2:2023-write-restricted | /webhooks/api/subscriptions/rename | This write operation is not protected by any security scheme. | | error | owasp:api4:2023-rate-limit | /webhooks/api/subscriptions/rename | All 2XX and 4XX responses should define rate limiting headers. | | error | owasp:api4:2023-rate-limit | /webhooks/api/subscriptions/rename | All 2XX and 4XX responses should define rate limiting headers. | | error | owasp:api4:2023-string-limit | #/components/schemas/ActivateSubscriptionResponse/properties/message | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/ActivateSubscriptionRequest/properties/config_id | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-integer-limit-legacy | #/components/schemas/ActivateSubscriptionRequest/properties/status | Schema of type integer must specify minimum and maximum. | | error | owasp:api4:2023-string-limit | #/components/schemas/CreateSubscriptionRecord/properties/configId | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/CreateSubscriptionRecord/properties/portalId | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/CreateSubscriptionRecord/properties/name | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/CreateSubscriptionRecord/properties/protocol | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/CreateSubscriptionRecord/properties/endpoint | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-array-limit | #/components/schemas/CreateSubscriptionRecord/properties/events | Schema of type array must specify maxItems. | | error | owasp:api4:2023-string-limit | #/components/schemas/CreateSubscriptionRecord/properties/events/items | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/CreateSubscriptionRecord/properties/subscriptionArn | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/CreateSubscriptionRecord/properties/topicArn | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/CreateSubscriptionResponse/properties/message | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-array-limit | #/components/schemas/SeqString | Schema of type array must specify maxItems. | | error | owasp:api4:2023-string-limit | #/components/schemas/SeqString/items | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/CreateSubscriptionRequest/properties/name | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/CreateSubscriptionRequest/properties/protocol | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/CreateSubscriptionRequest/properties/endpoint | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-array-limit | #/components/schemas/CreateSubscriptionRequest/properties/events | Schema of type array must specify maxItems. | | error | owasp:api4:2023-string-limit | #/components/schemas/CreateSubscriptionRequest/properties/events/items | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/ListSubscriptionItem/properties/configId | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/ListSubscriptionItem/properties/name | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/ListSubscriptionItem/properties/protocol | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/ListSubscriptionItem/properties/endpoint | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-array-limit | #/components/schemas/ListSubscriptionItem/properties/events | Schema of type array must specify maxItems. | | error | owasp:api4:2023-string-limit | #/components/schemas/ListSubscriptionItem/properties/events/items | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-integer-limit-legacy | #/components/schemas/ListSubscriptionItem/properties/status | Schema of type integer must specify minimum and maximum. | | error | owasp:api4:2023-string-limit | #/components/schemas/ListSubscriptionsResponse/properties/message | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-array-limit | #/components/schemas/ListSubscriptionsResponse/properties/configs | Schema of type array must specify maxItems. | | error | owasp:api4:2023-array-limit | #/components/schemas/SeqListSubscriptionItem | Schema of type array must specify maxItems. | | error | owasp:api4:2023-string-limit | #/components/schemas/RenameSubscriptionResponse/properties/message | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/RenameSubscriptionRequest/properties/config_id | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/RenameSubscriptionRequest/properties/name | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/UpdateSubscriptionEventsRecord/properties/configId | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/UpdateSubscriptionEventsRecord/properties/portalId | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-array-limit | #/components/schemas/UpdateSubscriptionEventsRecord/properties/events | Schema of type array must specify maxItems. | | error | owasp:api4:2023-string-limit | #/components/schemas/UpdateSubscriptionEventsRecord/properties/events/items | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/UpdateSubscriptionResponse/properties/message | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-array-limit | #/components/schemas/ListString | Schema of type array must specify maxItems. | | error | owasp:api4:2023-string-limit | #/components/schemas/ListString/items | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-string-limit | #/components/schemas/UpdateSubscriptionRequest/properties/config_id | Schema of type string must specify maxLength, enum, or const. | | error | owasp:api4:2023-array-limit | #/components/schemas/UpdateSubscriptionRequest/properties/events | Schema of type array must specify maxItems. | | error | owasp:api4:2023-string-limit | #/components/schemas/UpdateSubscriptionRequest/properties/events/items | Schema of type string must specify maxLength, enum, or const. | | warn | owasp:api4:2023-rate-limit-responses-429 | /webhooks/api/subscriptions/activate | Operation is missing rate limiting response in responses429. | | warn | owasp:api4:2023-rate-limit-responses-429 | /webhooks/api/subscriptions/activate | Operation is missing rate limiting response in responses429.content. | | warn | owasp:api8:2023-define-error-responses-401 | /webhooks/api/subscriptions/activate | Operation is missing responses401. | | warn | owasp:api8:2023-define-error-responses-401 | /webhooks/api/subscriptions/activate | Operation is missing responses401.content. | | warn | owasp:api8:2023-define-error-responses-500 | /webhooks/api/subscriptions/activate | Operation is missing responses500. | | warn | owasp:api8:2023-define-error-responses-500 | /webhooks/api/subscriptions/activate | Operation is missing responses500.content. | | warn | owasp:api4:2023-rate-limit-responses-429 | /webhooks/api/subscriptions | Operation is missing rate limiting response in responses429. | | warn | owasp:api4:2023-rate-limit-responses-429 | /webhooks/api/subscriptions | Operation is missing rate limiting response in responses429.content. | | warn | owasp:api8:2023-define-error-responses-401 | /webhooks/api/subscriptions | Operation is missing responses401. | | warn | owasp:api8:2023-define-error-responses-401 | /webhooks/api/subscriptions | Operation is missing responses401.content. | | warn | owasp:api8:2023-define-error-responses-500 | /webhooks/api/subscriptions | Operation is missing responses500. | | warn | owasp:api8:2023-define-error-responses-500 | /webhooks/api/subscriptions | Operation is missing responses500.content. | | warn | owasp:api4:2023-rate-limit-responses-429 | /webhooks/api/subscriptions | Operation is missing rate limiting response in responses429. | | warn | owasp:api4:2023-rate-limit-responses-429 | /webhooks/api/subscriptions | Operation is missing rate limiting response in responses429.content. | | warn | owasp:api8:2023-define-error-responses-401 | /webhooks/api/subscriptions | Operation is missing responses401. | | warn | owasp:api8:2023-define-error-responses-401 | /webhooks/api/subscriptions | Operation is missing responses401.content. | | warn | owasp:api8:2023-define-error-responses-500 | /webhooks/api/subscriptions | Operation is missing responses500. | | warn | owasp:api8:2023-define-error-responses-500 | /webhooks/api/subscriptions | Operation is missing responses500.content. | | warn | owasp:api4:2023-string-restricted | /webhooks/api/subscriptions/{configId} | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | /webhooks/api/subscriptions/{configId} | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-rate-limit-responses-429 | /webhooks/api/subscriptions/{configId} | Operation is missing rate limiting response in responses429. | | warn | owasp:api4:2023-rate-limit-responses-429 | /webhooks/api/subscriptions/{configId} | Operation is missing rate limiting response in responses429.content. | | warn | owasp:api8:2023-define-error-responses-401 | /webhooks/api/subscriptions/{configId} | Operation is missing responses401. | | warn | owasp:api8:2023-define-error-responses-401 | /webhooks/api/subscriptions/{configId} | Operation is missing responses401.content. | | warn | owasp:api8:2023-define-error-responses-500 | /webhooks/api/subscriptions/{configId} | Operation is missing responses500. | | warn | owasp:api8:2023-define-error-responses-500 | /webhooks/api/subscriptions/{configId} | Operation is missing responses500.content. | | warn | owasp:api2:2023-read-restricted | /webhooks/api/subscriptions/list | This read operation is not protected by any security scheme. | | warn | owasp:api4:2023-rate-limit-responses-429 | /webhooks/api/subscriptions/list | Operation is missing rate limiting response in responses429. | | warn | owasp:api4:2023-rate-limit-responses-429 | /webhooks/api/subscriptions/list | Operation is missing rate limiting response in responses429.content. | | warn | owasp:api8:2023-define-error-responses-401 | /webhooks/api/subscriptions/list | Operation is missing responses401. | | warn | owasp:api8:2023-define-error-responses-401 | /webhooks/api/subscriptions/list | Operation is missing responses401.content. | | warn | owasp:api8:2023-define-error-responses-500 | /webhooks/api/subscriptions/list | Operation is missing responses500. | | warn | owasp:api8:2023-define-error-responses-500 | /webhooks/api/subscriptions/list | Operation is missing responses500.content. | | warn | owasp:api4:2023-rate-limit-responses-429 | /webhooks/api/subscriptions/rename | Operation is missing rate limiting response in responses429. | | warn | owasp:api4:2023-rate-limit-responses-429 | /webhooks/api/subscriptions/rename | Operation is missing rate limiting response in responses429.content. | | warn | owasp:api8:2023-define-error-responses-401 | /webhooks/api/subscriptions/rename | Operation is missing responses401. | | warn | owasp:api8:2023-define-error-responses-401 | /webhooks/api/subscriptions/rename | Operation is missing responses401.content. | | warn | owasp:api8:2023-define-error-responses-500 | /webhooks/api/subscriptions/rename | Operation is missing responses500. | | warn | owasp:api8:2023-define-error-responses-500 | /webhooks/api/subscriptions/rename | Operation is missing responses500.content. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/ActivateSubscriptionResponse/properties/message | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/ActivateSubscriptionRequest/properties/config_id | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/CreateSubscriptionRecord/properties/configId | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/CreateSubscriptionRecord/properties/portalId | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/CreateSubscriptionRecord/properties/name | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/CreateSubscriptionRecord/properties/protocol | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/CreateSubscriptionRecord/properties/endpoint | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/CreateSubscriptionRecord/properties/events/items | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/CreateSubscriptionRecord/properties/subscriptionArn | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/CreateSubscriptionRecord/properties/topicArn | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/CreateSubscriptionResponse/properties/message | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/SeqString/items | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/CreateSubscriptionRequest/properties/name | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/CreateSubscriptionRequest/properties/protocol | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/CreateSubscriptionRequest/properties/endpoint | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/CreateSubscriptionRequest/properties/events/items | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/ListSubscriptionItem/properties/configId | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/ListSubscriptionItem/properties/name | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/ListSubscriptionItem/properties/protocol | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/ListSubscriptionItem/properties/endpoint | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/ListSubscriptionItem/properties/events/items | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/ListSubscriptionsResponse/properties/message | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/RenameSubscriptionResponse/properties/message | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/RenameSubscriptionRequest/properties/config_id | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/RenameSubscriptionRequest/properties/name | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/UpdateSubscriptionEventsRecord/properties/configId | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/UpdateSubscriptionEventsRecord/properties/portalId | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/UpdateSubscriptionEventsRecord/properties/events/items | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/UpdateSubscriptionResponse/properties/message | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/ListString/items | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/UpdateSubscriptionRequest/properties/config_id | Schema of type string should specify a format, pattern, enum, or const. | | warn | owasp:api4:2023-string-restricted | #/components/schemas/UpdateSubscriptionRequest/properties/events/items | Schema of type string should specify a format, pattern, enum, or const. |