Real-world API abuse rarely maps cleanly onto the OWASP API Top-10. In production, abuse looks like clients exercising the API within its stated contract in ways the operators did not expect: high-fanout queries, resource enumeration through legitimate endpoints, and rate-limit reset patterns.
The most productive frame we have found is to enumerate what a single legitimate client can accomplish per unit cost — network, database, and money — and to look for endpoints where that ratio is skewed against the operator.