API Security

API security protects application programming interfaces from unauthorized access, data leakage, and abuse. It covers authentication, authorization, input validation, rate limiting, transport encryption, and defense against injection and business-logic attacks targeting API endpoints.

itOffensive security and application security

Don't Panic — API Security

An API is the agreed way one piece of software asks another for data or an action. API security keeps that agreement from becoming a cheerful note saying “please take whatever you find.” The useful picture is a guarded contract at every trust boundary: the contract says what can happen, and the guards decide who may make it happen.

A request travels through transport, perhaps a gateway, then a service and its data or downstream systems. Here is the surprise. A gateway can route traffic, check a token's shape, and apply a shared limit. It does not know whether the caller owns order 731, may change creditLimit, or has reached the approve stage. The service holding that business knowledge must make those decisions. The gateway is helpful; it is not clairvoyant.

Keep authentication, authorization, and a schema separate. Authentication checks an identity claim. Authorization decides whether that identity may perform this action on this object now. A schema describes the allowed message shape. None substitutes for the others. A valid token can ask for somebody else's record. A well-formed request can attempt an invalid workflow transition. A random identifier can be found, copied, or leaked, then become a tidy route to an unauthorized object.

The contract also needs limits. One request can contain a large payload, a costly query, many batch operations, or a third-party charge. A rate limit counts requests over a short period; a quota counts total use over a longer one. Neither is a magical “no bad things” dial, which is inconvenient but honest. Bound the work that matters: concurrency, payload, query complexity, retries, storage, and cost.

Then keep an inventory. A shadow API is active but outside the governed inventory. A zombie API was replaced but remains reachable. Both are awkward because a control cannot protect a route nobody remembers exists. Compare contracts with deployments and observed traffic; otherwise the retirement plan is mostly a decorative suggestion.

Read the intro for the full guarded-contract model and authorization layers. Use the slides when the path through gateway and service needs a picture. Keep the cheatsheet nearby when reviewing token checks, limits, server-side request forgery, or an authorization matrix. Field Notes covers the operational traps that make a technically correct rule fail after it meets alternate paths, business flows, and deployment speed.

Don't Panic — API Security

Relevant careers