# What is API Security?

> API security is the design, implementation, testing, and operation of controls that protect application programming interfaces and the data and services they expose.

- Canonical URL: https://yellowcube.eu/glossary/application-programming-interface-security/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It spans the API lifecycle: knowing which interfaces exist, defining their trust boundaries and schemas, authenticating callers, authorizing every operation and object, validating messages, constraining resource use, protecting credentials and transport, monitoring behavior, and retiring old versions safely.

APIs expose machine-readable business capabilities, so technically valid requests can still be abusive. An authenticated user might request another customer’s record, enumerate identifiers, automate a costly workflow, or supply data that a downstream service trusts unsafely. Effective protection therefore combines gateway and edge controls with authorization and business rules implemented in the application.

### Key points

- **Maintain an inventory:** Record owners, versions, environments, schemas, data classifications, dependencies, exposure, and retirement status, including undocumented or forgotten APIs.
- **Enforce identity and authorization:** Validate tokens and audiences, use appropriate client authentication, and check object-, property-, and function-level permissions on every request.
- **Constrain input and consumption:** Validate structure and content, limit request size and expensive operations, control pagination and concurrency, and return only necessary data.
- **Operate securely:** Protect keys and tokens, encrypt transport, log security-relevant events without leaking secrets, test abuse cases, and verify the behavior of third-party APIs.
- **Important limitation:** An API gateway or WAF can reject many malformed or known-bad requests, but it usually cannot determine whether a valid-looking business action is authorized, safe, or fraudulent without application context.

### Related terms

[Application programming interface (API) gateway](<https://yellowcube.eu/glossary/application-programming-interface-gateway/>) · [Web application firewall (WAF)](<https://yellowcube.eu/glossary/web-application-firewall/>) · [Authentication](<https://yellowcube.eu/glossary/authentication/>) · [Authorization](<https://yellowcube.eu/glossary/authorization/>) · [OAuth 2.0](<https://yellowcube.eu/glossary/oauth-2-0/>) · [Application security](<https://yellowcube.eu/glossary/application-security/>)

### Sources

[NIST SP 800-228 update 1: Guidelines for API Protection for Cloud-Native Systems](https://csrc.nist.gov/pubs/sp/800/228/upd1/final) · [OWASP API Security Project](https://owasp.org/www-project-api-security/) · [OWASP API Security Top 10 – 2023](https://owasp.org/API-Security/editions/2023/en/0x03-introduction/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.