Security Misconfiguration is one of the top ten vulnerabilities in the OWASP list. Misconfigured security rules can lead to several types of “Services attack” where the API’s can be overwhelmed in several ways:
Injection : Commands or Macros can be passed to API’s as payloads which are then run in the background 
Malware : When API’s expect files such as a photos or documents, very Large files can be uploaded 
Abuse of Functionality : The API functionality can be exploited to attack itself