DVAPI — Damn Vulnerable API — is an intentionally vulnerable API application built as a CTF-style learning platform. It exists because API security is far easier to understand when you have actually broken something than when you have only read the list.
What it covers
DVAPI is built around the OWASP API Security Top 10 — 2023, published in June 2023. It walks all ten categories, from Broken Object Level Authorization through to Unsafe Consumption of APIs, as hands-on challenges rather than descriptions.
Each category is a thing you exploit in a running application, which changes how it lands. Broken Object Level Authorization stops being an acronym the moment you change an ID in a request and get somebody else’s data back.
Running it
The whole thing is containerised, so it is three commands to a working lab:
git clone https://github.com/payatu/DVAPI
cd DVAPI
docker compose up --buildThen open http://127.0.0.1:3000/. Swagger documentation and a Postman collection are included, so you can attack it from the browser or from your own tooling.
The talk
I presented this at BSides Bangalore — “Navigating the OWASP API Top 10 2023 landscape: insights from a Damn Vulnerable Lab” — walking the audience through the categories using the lab as the teaching surface.
The recurring theme: most API findings are not exotic. They are authorization decisions made in the wrong place, and they are invisible to a scanner because the request looks completely legitimate.
My part in it
I worked on DVAPI as one of its developers at Payatu, alongside the team that built and maintains it. It is open source and deliberately insecure — run it locally, never anywhere public.