It spans the API lifecycle: knowing which interfaces exist, defining their trust boundaries and schemas, authenticating callers, authorizing every operation and object, validating messages, constraining resource use, protecting credentials and transport, monitoring behavior, and retiring old versions safely.
APIs expose machine-readable business capabilities, so technically valid requests can still be abusive. An authenticated user might request another customer’s record, enumerate identifiers, automate a costly workflow, or supply data that a downstream service trusts unsafely. Effective protection therefore combines gateway and edge controls with authorization and business rules implemented in the application.
Key points
Maintain an inventoryRecord owners, versions, environments, schemas, data classifications, dependencies, exposure, and retirement status, including undocumented or forgotten APIs.
Enforce identity and authorizationValidate tokens and audiences, use appropriate client authentication, and check object-, property-, and function-level permissions on every request.
Constrain input and consumptionValidate structure and content, limit request size and expensive operations, control pagination and concurrency, and return only necessary data.
Operate securelyProtect keys and tokens, encrypt transport, log security-relevant events without leaking secrets, test abuse cases, and verify the behavior of third-party APIs.
Important limitationAn API gateway or WAF can reject many malformed or known-bad requests, but it usually cannot determine whether a valid-looking business action is authorized, safe, or fraudulent without application context.