Catalog
concept#Security#Integration#Architecture#Software Engineering

API Security

Strategies and controls to protect application programming interfaces (APIs) from abuse, data leakage and unauthorized access.

API security covers practices and technical controls that protect application programming interfaces from abuse, data leakage and unauthorized access.
Established
Medium

Classification

  • Medium
  • Technical
  • Architectural
  • Intermediate

Technical context

OAuth2 / OpenID Connect identity providersAPI gateways (e.g., Kong, Apigee)SIEM and alerting systems

Principles & goals

Least privilege: grant only necessary permissions.Defense in depth: combine multiple layers of protection.Fail-safe defaults: use restrictive defaults by default.
Build
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Misconfigured authentication leads to data leaks.
  • Excessive field disclosure in responses enables information gathering by attackers.
  • Insufficient monitoring delays detection of abuse.
  • Return minimal necessary data in responses.
  • Perform token validation and scope checks at service level.
  • Use rate limiting and quotas to protect against abuse.

I/O & resources

  • API inventory with endpoints and owners
  • Current threat models and risk analyses
  • Identity provider and access control strategies
  • Hardening policies and policy definitions
  • Configuration templates for gateways and proxies
  • Audit and monitoring reports

Description

API security covers practices and technical controls that protect application programming interfaces from abuse, data leakage and unauthorized access. Core aspects include authentication, authorization, input validation, encryption and monitoring. Clear policies and observability reduce attack surface and help ensure integrity, confidentiality and availability of exposed services.

✔

  • Reduces risk of unauthorized access and data leaks.
  • Improves traceability through logging and audits.
  • Enables secure integration of external partners and clients.

✖

  • Cannot prevent all zero-day vulnerabilities.
  • Introduction incurs additional configuration and operational effort.
  • Lack of standardization in legacy APIs complicates complete hardening.

  • Number of compromised API keys

    Counts registered incidents of compromised or abused API keys.

  • Mean time to detect (MTTD) for API attacks

    Average time to detect abusive access to APIs.

  • Percentage of secured endpoints

    Share of API endpoints that meet minimum security requirements.

Company A: API gateway as central policy layer

A SaaS provider deployed a gateway to centrally enforce auth and rate limiting, reducing abuse incidents.

Agency B: encryption and logging for sensitive endpoints

Mandatory TLS and audit logs made data access traceable and met compliance requirements.

Platform C: threat modeling before API launch

Early threat modeling led to secure input validation standards and reduced attack surface before production rollout.

1

Create and prioritize an API inventory.

2

Perform threat modeling for critical endpoints.

3

Define and implement central authN/authZ policies.

4

Introduce and tune monitoring, logging and alerts.

⚠️ Technical debt & bottlenecks

  • Non-versioned APIs make security updates harder.
  • Missing automation for security tests and scans.
  • Manual key management instead of centralized rotation.
Authentication validationThroughput/performanceLogging and storage for audit data
  • Public API without rate limiting and without authentication.
  • Sensitive fields in API responses not masked.
  • Direct access to internal services without gateway policies.
  • Overestimating TLS as the sole protection mechanism.
  • Underestimating consequences of token theft.
  • Overly complex policy rules that developers circumvent.
Security engineering and threat modelingKnowledge of OAuth2/OpenID and token managementNetwork and API architecture understanding
Compliance requirements and data protectionScalability and performance of APIsInteroperability with identity providers and gateways
  • • Legacy APIs without token support
  • • Latency requirements for real-time APIs
  • • Regulatory rules for data residency