API Security

API security protects application programming interfaces from unauthorized access, data leakage, and abuse. It covers authentication, authorization, input validation, rate limiting, transport encryption, and defense against injection and business-logic attacks targeting API endpoints.

itOffensive security and application security

API Security

An application programming interface, or API, defines how one software component asks another component to read data or perform an action. API security protects that exchange from unauthorized use, unsafe input, excessive consumption, and unintended disclosure.

The useful mental model is a guarded contract at every trust boundary. The contract describes allowed operations, inputs, outputs, and errors. The guards establish identity, authorize the exact action, validate the exchange, limit consumption, and record evidence.

client identity and request
           ↓
transport → gateway controls → service controls → business logic
                                      ↓                ↓
                               authorization      data and actions
                                      ↓                ↓
                             response validation ← response

An API gateway can apply shared controls. It cannot know every object, field, workflow state, or business rule. The service that owns a resource must still enforce those decisions.

Why APIs need their own security view

APIs expose application logic and data in a form that software can call repeatedly. A legitimate client can become an attack tool by changing an object identifier or adding a property. It can also switch an HTTP method, replay a workflow step, or automate a sensitive business flow.

The browser or mobile interface is not a security boundary. Attackers call the API directly. They can ignore hidden buttons, client-side validation, navigation order, and assumptions built into the official client.

Internal APIs need the same security reasoning. A network location does not prove which service or user initiated a call. Authenticate the calling service where the architecture requires it. Preserve the end-user identity when one service acts for a user. Authorize both identities against the requested operation and resource.

API security applies before and during runtime:

Pre-runtime controls define the contract, schemas, ownership, permissions, data classifications, tests, and retirement plan.
Runtime controls encrypt traffic, authenticate callers, authorize actions, validate messages, enforce limits, and produce telemetry.

The two sets depend on each other. Runtime enforcement is unreliable when the organization does not know which APIs exist or what their contracts permit.

Start with the API contract

An API contract describes the operations a client can call. It also describes request and response shapes, field types, required values, errors, and authentication expectations.

API Security

Why APIs need their own security view

Start with the API contract

Relevant careers