CWE - CWE-227: CWE CATEGORY: 7PK Archived: 2026-04-05 15:33:07 UTC CWE CATEGORY: 7PK - API Abuse Category ID: 227 Vulnerability Mapping: PROHIBITED This CWE ID must not be used to map to real-world vulnerabilities Summary This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated." Membership Nature Type MemberOf View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) an MemberOf Category - a CWE entry that contains a set of other entries that share a common characteristic. HasMember Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods HasMember Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific th HasMember Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific th HasMember Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific th HasMember Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific th https://cwe.mitre.org/data/definitions/227.html Page 1 of 4 HasMember Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods HasMember Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods HasMember Category - a CWE entry that contains a set of other entries that share a common characteristic. HasMember Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods HasMember Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific th Vulnerability Mapping Notes Usage: PROHIBITED (this CWE ID must not be used to map to real-world vulnerabilities) Reason: Category Rationale: This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves. Comments: See member weaknesses of this category. References Content History Submissions Submission Date Submitter Organization 2006-07-19 (CWE Draft 3, 2006-07-19) 7 Pernicious Kingdoms Modifications Modification Date Modifier Organization 2008-07-01 Eric Dalci Cigital updated Time_of_Introduction 2008-09-08 CWE Content Team MITRE updated Description, Relationships, Taxonomy_Mappings 2009-05-27 CWE Content Team MITRE updated Name, Relationships https://cwe.mitre.org/data/definitions/227.html Page 2 of 4 Submissions 2010-02-16 CWE Content Team MITRE updated Relationships, Taxonomy_Mappings 2010-12-13 CWE Content Team MITRE updated Description 2011-03-29 CWE Content Team MITRE updated Description, Name 2011-06-01 CWE Content Team MITRE updated Common_Consequences 2011-06-27 CWE Content Team MITRE updated Common_Consequences 2012-05-11 CWE Content Team MITRE updated Relationships 2012-10-30 CWE Content Team MITRE updated Observed_Examples, Potential_Mitigations 2013-07-17 CWE Content Team MITRE updated Relationships 2014-07-30 CWE Content Team MITRE updated Relationships 2017-01-19 CWE Content Team MITRE updated Relationships 2017-05-03 CWE Content Team MITRE updated Observed_Examples, Related_Attack_Patterns 2017-11-08 CWE Content Team MITRE updated Alternate_Terms, Common_Consequences, Description, Name, Observed_Examples, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings, Time_of_Introduction, Type 2019-01-03 CWE Content Team MITRE updated Relationships 2020-02-24 CWE Content Team MITRE updated Description, References, Relationships 2023-04-27 CWE Content Team MITRE updated Mapping_Notes 2023-06-29 CWE Content Team MITRE updated Mapping_Notes Previous Entry Names Change Date Previous Entry Name 2008-04-11 API Abuse 2009-05-27 Failure to Fulfill API Contract (aka 'API Abuse') 2011-03-29 Failure to Fulfill API Contract ('API Abuse') 2017-11-08 Improper Fulfillment of API Contract ('API Abuse') https://cwe.mitre.org/data/definitions/227.html Page 3 of 4 Source: https://cwe.mitre.org/data/definitions/227.html https://cwe.mitre.org/data/definitions/227.html Page 4 of 4