<![CDATA[The advancement of Application Programming Interfaces (APIs) demands measurable architectural-level security evaluation. This study quantifies the security risks of REST API and GraphQL based on three authorization categories from the OWASP API Security Top 10 2023 (API1, API3, and API5). The exclusive limitation to these three categories was established to focus purely on access control logic flaws rather than infrastructure-level vulnerabilities. The experiment utilizes TixVuln, a parallel-architecture testbed instrument explicitly designed to eliminate external database bias a comparative advantage not present in standard single-architecture vulnerable applications. Authorization evaluation was executed contextually to avoid the high false-negative rates typically produced by automated security scanning tools (SAST/DAST) in business logic testing. Quantification results using the OWASP Risk Rating Methodology reveal a novelty that GraphQL experiences a risk category escalation from Medium to Critical levels in API3 and API5 compared to REST API. This significant leap in the Ease of Discovery metric is absolutely triggered by the operational schema exposure through the introspection feature. Mitigation testing validates that implementing field whitelisting and resolver-level Role-Based Access Control is imperative to suppress inherent risks in single-endpoint architectures. The main contribution of this research is the provision of an isolated empirical evaluation framework that quantitatively proves the flexibility of GraphQL architecture is directly proportional to the increased fatality of authorization risks if the schema discovery feature is not strictly configured.]]>
