Glossary · simply explained

API security

API security protects interfaces against abuse: discovery against shadow APIs, schema validation, authentication and limits.

API security covers all measures that protect programming interfaces (APIs) against abuse, data exfiltration and overload. APIs carry the majority of dynamic traffic today — mobile apps, partner integrations, microservices and AI agents communicate via interfaces that classic security concepts often treat as an afterthought.

The biggest risk is rarely a single vulnerability but ignorance of your own attack surface: systematic discovery regularly finds significantly more active endpoints than documented — forgotten test routes, legacy versions, internally intended interfaces exposed to the internet.

The building blocks of effective API security

It starts with visibility: automatic endpoint discovery inventories what is actually reachable — including shadow APIs. Building on that, schema validation following the positive model enforces that only specified requests get through: what is defined is allowed, everything else is rejected.

Add strong authentication and authorisation (such as OAuth or mTLS for machine identities), request-level rate limits for expensive endpoints, and anomaly-based abuse detection that also catches formally valid but suspicious usage patterns — guided by the OWASP API Security Top 10.

Typical API risks

Shadow APIs: reachable endpoints nobody knows about and nobody protects.
Broken object level authorization: access to other records via manipulated IDs.
Missing limits on expensive endpoints — up to cost explosions or outages.
Excessive data responses that reveal more than the client needs.

Frequently asked questions about API security

What are shadow APIs?

Shadow APIs are active, reachable endpoints that appear in no documentation — forgotten test routes, old versions or internally intended interfaces exposed to the internet. They are preferred targets because they are unprotected and unobserved. Automatic discovery makes them visible.

Is a WAF enough for API protection?

A WAF provides baseline protection against known attack patterns but does not understand the logic of an API. Effective API protection adds discovery, schema validation following the positive model, authentication and abuse detection — operated together as a WAAP platform.

What is schema validation with a positive model?

Instead of listing what is forbidden, the positive model defines what valid requests look like — paths, parameters, data types. Anything that does not match the specification is rejected. That stops entire attack classes, including ones without a signature yet.

Why are rate limits so important for APIs?

Expensive endpoints such as search, login or checkout can be strained at will without limits — for brute force, scraping or simply driving up costs. Request-level throttling limits the damage without hindering legitimate use.

How fast are new API vulnerabilities exploited?

Attackers scan automatically: in the documented extreme case, only 22 minutes passed between the publication of an exploit example and the first attack attempts. That is why virtual patching at the network edge is part of API protection — it shields before systems are updated.